Research map / Multi-agent systems and games / LLM agents

Position: AI Agents Need Authenticated Delegation

ICML 2025 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Position paper arguing AI agents need authenticated, auditable delegation of authority, proposing an extension of OAuth 2.0/OpenID Connect with agent IDs, delegation tokens, and natural-language-to-structured permission scoping.

Problem

AI agents acting on users' behalf lack verifiable identity, delegated authority, and scoped permissions when interacting with web services and other agents, creating risks in authorization, accountability, and access control.

Approach

Extend OIDC and OAuth 2.0 (with UMA) to issue user ID tokens, agent-ID tokens, and signed delegation tokens, and convert natural-language permissions into structured, human-approved resource-scoping rules (e.g., XACML) rather than relying on prompts alone.

Key results

• No experiments are reported; the paper presents a conceptual framework and illustrative use cases.
• Argues OAuth 2.0 and OpenID Connect can be extended with agent-specific credentials and delegation tokens while remaining compatible with existing web infrastructure.
• Argues that structured resource scoping is more reliable than pure natural-language permissions, with LLM translation validated by the human delegator.

Surprising findings

• Argues that OpenAI Operator's storage of login credentials as browser cookies is insecure, limiting revocation and auditing.
• Argues that model vendors' current sharing of user identity via user-agent strings or API calls is insufficient from a security perspective.

Limitations

• Natural-language-to-policy translation may be unreliable and opens new LLM-based attack surfaces.
• OIDC introduces sign-in overhead, centralizes privacy risk with providers, and may be overly complex versus simpler alternatives.
• Specific workflow for LLM translation and its robustness is left to future work; no empirical validation.

Experimental setup

Baselines: Model Context Protocol (MCP) OpenAI Operator Agent-to-Agent Authentication (A2A)

Builds on: OAuth 2.0 OpenID Connect User-Managed Access (UMA) W3C Verifiable Credentials XACML

Closest papers by meaning

• Optimizing Agent Planning for Security and Autonomy (ICLR 2026 · similarity 0.84)
• OpenAgentSafety: A Comprehensive Framework For Evaluating Real-World AI Agent Safety (ICLR 2026 · similarity 0.83)
• Securing AI Agents with Information-Flow Control (NeurIPS 2026 · similarity 0.83)
• MINIM: Privacy-Aware Minimal View for Agents via Trusted Local Sanitization (ICML 2026 · similarity 0.83)
• Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents (ICLR 2026 · similarity 0.83)
• LiSA: Lifelong Safety Adaptation via Conservative Policy Induction (NeurIPS 2026 · similarity 0.82)