Security · 2026-03-06
Delegating Identity to AI Agents Without Delegating Trust
By J. W. Bouckaert
The trust problem
Enterprise AI adoption is accelerating. Agents process invoices, manage customer tickets, orchestrate infrastructure, and execute trades. But every agent with system access is a potential attack vector—and frameworks like the NIST AI Risk Management Framework now require organizations to govern that exposure explicitly.
The fundamental question isn't whether to use AI agents. It's how to give them identity without giving them trust.
For the foundational framework, see Agentic Identity: Scoped Digital Delegates for AI Agents.
The NF-05 philosophy
PasskeyBridge's NF-05 specification defines a trust model for autonomous identity delegates based on three principles:
- Minimum viable identity—Agents receive the narrowest possible scope for their task
- Behavioral trust scoring—Trust is earned through consistent, predictable behavior, not granted at issuance
- Graduated scope narrowing—Anomalous behavior triggers automatic scope reduction ahead of any revocation
This is a fundamental departure from the binary model (access/no-access) that most identity systems use today, and it aligns with the least-privilege scoping primitives being formalized in OAuth 2.1.
Behavioral trust scoring
Every digital delegate in PasskeyBridge carries a trust score between 0.0 and 1.0. The score is computed by the Agent Trust Engine based on behavioral signals:
- Velocity analysis: Is the agent making requests at an unusual rate?
- IP rotation detection—Is the agent's network origin changing unexpectedly?
- Scope violations—Is the agent asking for scopes it does not hold?
- Temporal consistency—Is the agent active outside its normal operating window?
- Error rate monitoring—Is the agent generating an unusual number of failed requests?
The score is recomputed from the delegate's recent activity.
Graduated scope narrowing
When an agent's trust score drops, PasskeyBridge doesn't immediately revoke the delegate. Instead, it narrows the scope:
- Score ≥ 0.7—Full access: all originally granted scopes remain active
- Score ≥ 0.4—Read-only: write operations are suspended, read scopes remain
- Score ≥ 0.2—Verify-only: the agent can verify its own identity but take no actions
- Below the revocation floor (0.2 by default)—the delegate is deactivated and the change is written to the audit trail
These are the platform defaults. A tenant can set its own full-access and read-only thresholds.
This graduated response prevents false positives from causing operational disruption. A temporary velocity spike doesn't kill a production agent—it constrains it until behavior normalizes.
Deterministic overrides
Some signals are too critical for graduated response. When PasskeyBridge's Pillar I signal ingest receives a hard signal such as a SIM swap or device compromise on a live API key, every active delegate in the tenant is deactivated at once, whatever its trust score and whichever member issued it. This is the parametric revocation engine at work.
Scope restoration
If a narrowed agent's behavior returns to normal, its trust score recovers naturally. When the score crosses back above the threshold, scopes are automatically restored to their original configuration. The narrowing event, duration, and restoration are all logged to the append-only audit trail for SOC 2 readiness.
Integration with the three pillars
- Pillar I—Carrier signals trigger deterministic overrides; playbook actions can include delegate suspension
- Pillar II—Delegates can be issued as verifiable credentials, enabling cross-platform trust verification
- Pillar III—Creating a delegate requires a signed-in member of the tenant, and the delegate record stores who created it
The case for enterprises now
Enterprises subject to rules such as Reg S-ID need to show that autonomous systems operated within authorized boundaries. The risks are catalogued explicitly in the OWASP Non-Human Identities Top 10, which identifies overprivileged service accounts, secret sprawl, and missing behavioral controls as the dominant failure modes. PasskeyBridge's trust scoring and scope narrowing provide the audit evidence regulators require—score changes larger than 0.05, every scope narrowing and every restoration are logged.
The alternative is shared API keys with no behavioral monitoring, no scope enforcement, and no audit trail.