When an Agent Acts on Your Behalf, Who Holds the Keys?#

Mariusz Sabath & Maia Iyer, IBM Research

• Why: The delegation problem stated precisely — when an agent commits code or triggers a workload, static API keys cannot express who actually authorized it, which makes both fine-grained authorization and audit impossible. That is an identity architecture question, not an AI one.
• What: An architecture that cryptographically binds agent identity to delegated user identity, so every action traces to both the code that executed it and the person who approved it.
• How: SPIRE's workload attestation extended to produce a verifiable agent identity; Keycloak acting as an OAuth 2.0 server manages the delegated user identity and preserves context across long, nested transactions; an open-source MCP Gateway enforces policy and audit at a single trusted point between agents and tools.
• Where applicable: Enterprise agent deployments. Research-origin, and the delegation-chain pattern is the transferable part regardless of whether you adopt this particular gateway.