Digital Identity and Dynamic Authorization in Multi-Agent Systems

Multi-agent stacks built on Anthropic MCP and Google A2A still rely on static API keys, and a NimbleBrain 2026 scan found only about 8.5 percent of MCP servers using OAuth. China Mobile researchers propose five controls: self-attenuating capability tokens, intent-bound credentials, append-only tracing, cross-protocol identity standards, and zero-trust continuous checks.

Agents Rewrite the Trust Boundary

AI systems are moving from passive tools to agents that initiate operations, coordinate business processes, and interact with internal and external systems on behalf of organizations. Anthropic's Model Context Protocol (MCP) and Google's Agent-to-Agent (A2A) protocol have widened tool calling and lateral collaboration. Agents now show non-deterministic task reasoning, autonomous tool use, and cross-environment context understanding.

A fully automated cybersecurity threat-response agent illustrates the shift. When it sees unknown traffic anomalies, it does not follow a fixed alert policy. It decomposes tracing work, calls external sandboxes and intelligence libraries through MCP, coordinates partners through A2A to block contaminated paths, and may isolate assets across cloud platforms. That model crosses organizational boundaries and invalidates trust assumptions based on those boundaries. A digital identity system that can handle dynamic, cross-domain collaboration is required.

Static Credentials Remain a Weak Point

Inter-system traffic still commonly uses API keys or bearer tokens. Static credentials authenticate the key, not the principal. If keys leak through a code repository or a CI/CD pipeline, any holder can impersonate a legitimate agent and start sensitive operations. Keys also cannot encode capability attributes, intent context, or constrained scope. They cannot decay as an authorization chain is passed, and they cannot confine an agent to a time window, an operation allowlist, or a budget. Coarse control that grants full takeover after one authorization produces privilege overflow.

MCP's March 2025 specification update made OAuth 2.0/2.1 an optional authorization layer. A NimbleBrain 2026 scan found that only about 8.5 percent of servers actually used OAuth. In A2A practice, agent credentials often carry only self-asserted identity, with no mandatory verification. When agent A delegates to agent B, current mechanisms cannot verify that A has lawful authority to issue the task, cannot impose a real permission boundary on B, and cannot produce a complete delegation record for later audit.

From Task Decomposition to Intelligent Delegation

Google's report "Intelligent AI Delegation" states that many so-called multi-agent systems remain at task decomposition. They split goals with hard-coded rules and schedule modules through simple parallelization or preset flows. That works in controlled experiments and fails in open environments. True delegation couples process orchestration with security authorization: precise permission transfer and chained responsibility. Design must address who is accountable for outcomes, how failure is attributed, whether the full chain is traceable, and whether results can be independently verified.

Gaps in IAM, SPIFFE, DID, and Delegation Tokens

OAuth 2.0/2.1 and OpenID Connect (OIDC) were built for human users authorizing third-party apps. In high-volume autonomous agent ecosystems they show several mismatches. OAuth cross-domain authorization rests on preconfigured federations, such as registered clients and assigned keys. Open multi-agent settings often require spontaneous peer-to-peer contact with unfamiliar nodes. Federated learning and dynamic alliances have no unified trust center, and participants change. Authorization-code flows bind browser redirects and explicit human consent, which is impractical for sub-millisecond machine-to-machine traffic. When agent A delegates to B and B calls C, OAuth tokens do not make intermediate proxies visible and cannot encapsulate the full chain.

SPIFFE supplies machine identities (SVIDs) for microservices but depends on public key infrastructure and X.509 certificates, with a centralized certificate authority as the trust anchor. Temporary SPIFFE trust-domain federations across organizations are costly and inflexible. Frequent certificate issuance and revocation for short-lived agents creates performance bottlenecks.

W3C decentralized identifiers (DID) and verifiable credentials (VC) let entities create and control identity without a central server. DID verification often requires ledger or blockchain resolution, which conflicts with sub-millisecond interaction. DID can prove possession of a private key for an identifier. That is not business trust. Granting high-risk permissions still depends on reputation systems, registries, or authority endorsement, which reintroduces centralized anchors.

Least-privilege delegation requires an upstream agent to reduce downstream scope unilaterally and offline. Signed JWTs cannot be modified after signing, so shrinking privileges requires a new token from a central server. Shared-secret Macaroons expose a risk that every verifying node could forge. Existing schemes generally lack append-only recovery of the original delegation chain, creating accountability gaps in finance and healthcare.

Four Systemic Risks

Privilege pass-through is the core risk in multi-hop flows. Credentials cannot decay dynamically along the chain, so upstream agents often pass full high-privilege credentials instead of a least-privilege slice. Downstream agents hold excess rights, and privilege accumulates with hop count. An edge agent at the end of a long path can become the most over-privileged point.

Intent disconnect allows chain contamination. Credentials prove identity and capability, not intended action. If a mid-chain agent is altered by prompt injection or knowledge-base poisoning, downstream nodes check only credential validity, not whether the instruction matches original intent. Contaminated instructions then travel on legitimate trust paths.

Accountability fails when tracing is missing. In financial transactions and medical diagnosis, a decision may pass through many hops. Traditional authorization cannot cryptographically bind node intent, context, and delegation into tokens. Audits cannot separate model hallucination, ambiguous human instruction, and malicious input. That conflicts with AI rules on transparency and human oversight.

Trust-path hijacking follows identity lifecycle lag. Task-specific sub-agents are destroyed after use, but identity infrastructure does not match that tempo. DID on-chain update delay or certificate revocation list lag leaves a window in which the agent is gone and the credential remains. Captured stale credentials can impersonate nodes and change task goals. Perimeter controls often fail against internally wrapped legitimate identities.

Five Governance Measures

First, replace static tokens with capability tokens that reduce privileges offline through cryptography. Encode time limits, budget caps, and call allowlists in the credential so multi-hop transfer follows least privilege.

Second, bind identity to task intent. Credentials should encapsulate upstream original task context and core decision intent. Downstream nodes should verify identity and check intent consistency.

Third, use append-only cryptographic signatures to bind each hop's delegation flow and input-prompt hashes to the trust chain, supporting audit and regulatory compliance.

Fourth, break identity silos among MCP, A2A, and other protocols. Unified agent naming, discovery, and semantic resolution would let domains parse one another's capabilities and authorization bounds.

Fifth, move from a single handshake to lifecycle behavior verification under a zero-trust model. Combined with privacy-preserving techniques such as zero-knowledge proofs, systems can assess interaction-chain baselines and apply micro-segmentation when behavior diverges from expected patterns.

Zhang Mengyuan and Zhang Yan work at the Security Technology Institute of China Mobile Research Institute (China Mobile AI Security Governance Research Center) on cryptography and security protocols. The article was reviewed by Yang Kai of the same institute.