AgentIAM: Open Spec for AI Agent Identity & Access Management in the Autonomous Era

As large language models evolve from conversational assistants into autonomous AI agents capable of planning, tool use, and cross-system collaboration, a society of billions of self-directed agents is emerging. When agents sign contracts, manage assets, and operate infrastructure on behalf of humans, two fundamental questions arise: how to prove an agent's identity, and how to keep its autonomous actions within legal and compliance boundaries.

Why Traditional IAM Fails for AI Agents

Traditional identity and access management (IAM) was designed for two principal types: humans and static services/machines. It falls short for AI agents for several reasons:

Static machine identities (API keys, service accounts) cannot handle the runtime uncertainty of agents that dynamically decompose tasks and combine tools based on prompts.

Human-centric identities rely on sessions and multi-factor authentication, which do not map to disembodied, highly concurrent autonomous agents.

When an agent suffers a prompt injection attack or falls into a confused deputy vulnerability, traditional IAM cannot detect that a seemingly legitimate agent has been subverted.

AgentIAM was created to fill this cross-era distributed security gap.

AgentIAM Architecture: The Seven-Part Specification

AICTRI's AgentIAM (specification identifier: agent-iam-series, current version: 0.4.1-draft) is a complete open-source interoperability specification suite, not merely a commercial component. It consists of seven tightly integrated parts:

Part 1: Architecture – Defines the zero-trust macro topology and core conceptual model of the agent society.

Part 2: Registration & Discovery – Specifies how agents announce their existence, capabilities, and governing authority to the network.

Part 3: Authentication – Solves workload attestation and proof-of-possession (PoP) for agent credentials.

Part 4: Authorization – Addresses dynamic decision-making, execution grants, and prevention of delegation amplification.

Part 5: Federation – Enables secure cross-domain identity recognition across organizational boundaries and cloud platforms.

Part 6: Audit – Creates tamper-evident, legally admissible evidence chains for every agent reasoning and action step.

Part 7: Conformance – Provides test vectors to ensure vendor implementations interoperate correctly.

Core Technical Innovations

1. Novel Agent Identity Entity Model

The specification establishes four core identity objects for the digital world:

Separation of Agent (agent prototype) and Agent Instance (runtime instance) solves identity uniqueness when AI models are copied and distributed multiple times.

Introduction of Authority Root and Authority Binding ties each agent to human legal and property frameworks, making clear who is accountable for the agent's behavior.

2. Lifecycle Epoch and Freshness

Agents may undergo "personality shifts" due to model upgrades, prompt tampering, or poisoning. AgentIAM introduces lifecycle epochs and a revocation-state refresh rate (Freshness). Any environmental anomaly immediately invalidates the current epoch, instantly revoking stale credentials.

3. Delegation Non-Amplification

This is AgentIAM's core contribution to multi-agent systems. When a user authorizes Agent A to book a flight, and Agent A calls Agent B (weather) and Agent C (payment), the permissions must not be amplified along the delegation chain. The specification constrains the dynamic scope of execution grants so that every hop stays strictly within the user's original intent.

Three Reference Implementations: The Trust Plane Flywheels

To validate the specification's practicality, AICTRI has built three core reference components that together form the complete AgentIAM runtime environment:

NOMIVELA – Agent Registry : Manages the authority namespace and authority bindings; acts as the agent's "household registration" and discovery center. Analogous to distributed DNS, UDDI, or root CA.

EIDOVELA – Authentication Provider : Consumes registry records, performs dynamic enrollment and environment measurement for workloads, and issues short-lived identity tokens with PoP proofs. Analogous to an Identity Provider (IdP) or Security Token Service (STS).

AEGIVELA – Authorization Plane : Resolves the agent principal model, evaluates policy decisions dynamically, issues execution grants, and handles real-time credential revocation. Analogous to Policy Decision/Enforcement Points.

Open Source Licensing and Future Evolution

AICTRI believes AI-era identity security must be public digital infrastructure, not monopolized by any single cloud vendor. Accordingly:

Specification text is licensed under CC BY 4.0 , encouraging free industry-wide reference and improvement.

Schemas and code tooling use the Apache-2.0 license, business-friendly with no downstream restrictions.

Although still in Project draft stage, the specification's theoretical completeness already surpasses existing drafts such as the IETF WIMSE AIMS documents. With the explosion of agent interconnection protocols like Model Context Protocol (MCP), AgentIAM is poised to become the indispensable firewall connecting AI capabilities with human governance.

The project invites platform engineers, AI safety researchers, and digital civilization scholars to join the open-source effort. The GitHub repository is at github.com (full path to be confirmed). Contributors should review CONTRIBUTING.md and the rfcs/ directory to submit change proposals.