One thing we’ve realized working on agent identity is that traditional IAM starts to show its limits pretty quickly once an AI agent acts outside your organization.
IAM is very good at answering who a user is, whether they can authenticate, and what they can access.
But when that user delegates an action to an AI agent, and the agent later interacts with a merchant, payment provider, or another external system, a different question appears:
How does that third party know what the agent was actually authorized to do?
That is where agent identity becomes a bigger problem than simply giving an AI agent an identifier.
The missing layer is portable, verifiable authority
An agent may be able to prove, "I am Agent X."
But that does not prove the user authorized Agent X to spend up to $500, transact with a particular merchant, or make this specific purchase.
Today, that context often lives inside one company's IAM system, application logic, agent configuration, or prompt.
That works inside one trust domain. It becomes much harder when an agent acts across organizations.
This is what makes the AP2 protocol interesting from an identity perspective.
In a human-not-present flow, the user signs Open Checkout and Payment Mandates that define the constraints under which an agent can act. That authority is bound to a specific agent key.
The agent later creates Closed Mandates for the actual checkout and payment, linking the transaction back to the authority the user granted.
Instead of relying only on internal logs, the relevant parties can verify signed artifacts.
A system prompt is not a security boundary
Telling an agent, "Do not spend more than $500," may guide the model. It does not reliably enforce the limit.
In the AP2 implementation we built, mandate consistency, agent authorization and payment constraints are checked server-side before a Closed Payment Mandate is signed.
If a request is outside the user's authorization, it can be rejected even if the model tries to continue.
The model can decide what it wants to do.
The authorization and application controls determine whether it is allowed to proceed.
From portable identity to portable authority
For years, digital identity has focused on making trusted facts about people portable.
Agentic systems add another category: authority.
Not just: Alice is over 18.
But: Alice authorized this specific agent to perform this type of action, under these conditions.
That may be one of the biggest opportunities for the identity industry as agents start acting across organizational boundaries.
