AI agents act for people, choose their own actions at runtime, and read content that may be hostile. This post sets out the problem, the three layers needed to handle it, and a reference architecture built on standards that exist today.

An agent needs an identity of its own, separate from the user it works for. Without one, every call it makes looks like the user made it, and you cannot revoke, rate-limit or audit the agent without doing the same to the person. This part covers how an agent gets that identity, as an OAuth client …