AI agents act for people, choose their own actions at runtime, and read content that may be hostile. This post sets out the problem, the three layers needed to handle it, and a reference architecture built on standards that exist today.

An agent needs an identity of its own, separate from the user it works for. Without one, every call it makes looks like the user made it, and you cannot revoke, rate-limit or audit the agent without doing the same to the person. This part covers how an agent gets that identity, as an OAuth client …

Part 2 gave the agent an identity. This part is about what happens when that agent acts for someone, and when the work passes through more services than the one the user consented to. The core tool is OAuth 2.0 Token Exchange (RFC 8693). Two OAuth working-group drafts extend it: one inside a trust …

Agents act while the user is somewhere else. Sooner or later a decision needs a person: to grant access in the first place, to prove it is really them, to approve something they cannot approve alone, or to confirm one specific action. This part maps each of those moments to the standard that handles …

Parts 1 to 6 built the controls. This part is about keeping them working once agents are live: recording what happened in a way you can trust, changing policy without breaking everything, noticing when a signal stops arriving, and pulling one agent out without taking its user down with it.