A person-agent workflow is a process where a human and an AI agent share work across a single business task. The person sets goals, approvals, or exceptions, while the agent performs defined actions. In identity security, this requires clear authorization, scoped access, logging, and controls for delegated decisions and data use.
How Person-Agent Workflows Change Authorization
A person-agent workflow only works safely when the human and the agent do not share open-ended authority. The human should approve goals, exceptions, or sensitive transitions, while the agent operates inside a clearly bounded policy envelope that matches the task.
This is why authorization design matters more than simple access grant. The workflow must define what the agent may do on its own, what needs explicit human confirmation, and where the system should fail closed when context changes or a request exceeds scope.
For agent delegation patterns, AI Agent Authorisation Guide is the most direct reference for task-scoped access, per-action decisions, and approval gates.
Identity, Delegation, and Scoped Access
Person-agent workflows depend on a defensible identity model for the agent itself. If the agent is acting on behalf of a person, the system needs to know whether it is using delegated authority, a task-scoped token, or some other controlled form of impersonation or shared access.
That distinction affects both governance and security. A workflow with weak identity separation can blur who approved an action, who executed it, and which permissions were actually used, which makes abuse and incident review much harder.
The broader identity model for delegation is covered well in Agentic AI Identity Guide, especially where agents need registration, authentication, and retirement rules.
When organisations want the identity layer mapped across standards and control models, the Agent Identity Standards Tracker helps place delegation and identity chaining in a wider ecosystem view.
Logging, Attribution, and Auditability
Because a person-agent workflow splits work between two actors, auditability has to preserve the boundary between human decision and agent execution. Good logs should show what the person requested, what the agent did, what data it accessed, and whether any step depended on a policy decision or confirmation.
That matters for both accountability and containment. If an agent drifts from its intended task, clear telemetry is the fastest way to spot unexpected actions, reconstruct the sequence, and decide whether access should be paused or revoked.
AI Agent Observability, Audit and Incident Response Guide is the relevant companion for attribution, kill-switch thinking, and agent incident review.
For environments where agents operate across multiple systems, Multi-Agent and A2A Security Guide adds useful coverage of authentication and delegation chains between agents.
Why Person-Agent Workflows Are Useful, and Where They Break
The main value of a person-agent workflow is speed with oversight. The agent can carry out repeatable actions, while the person retains judgment over ambiguous, high-impact, or exception-based decisions. That division is powerful when the task has clear rules but still needs human accountability.
The failure mode is overextension. Once an agent is allowed to act outside its intended scope, or once humans stop reviewing exceptions because the workflow feels routine, the system can silently turn convenience into excessive agency.
For that reason, the practical design question is not whether to use a person-agent workflow, but how to keep authority bounded as the workflow grows. The answer usually depends on whether the agent is executing a narrow task or accumulating broader operational trust over time.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Person-agent workflows hinge on delegated agent authority and scoped approvals. |
| Recommendation — Constrain each agent action to approved authority and require human confirmation for privilege-bearing steps. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Non-Organizational Users) | External or delegated agent actors need clear authentication and identity handling. |
| AU-2 — Event Logging | Workflow safety depends on recording who approved, what the agent executed, and when. | |
| AC-6 — Least Privilege | The workflow requires restricting the agent to task-scoped permissions and exceptions only. | |
| Recommendation — Authenticate non-organizational actors and bind each delegated workflow step to a verified identity. Log agent actions and human approvals with enough detail to reconstruct delegated decisions. Assign the minimum permissions needed for the task and remove standing access where possible. | ||
| NIST Zero Trust (SP 800-207) | 3.1 — Verify explicitly and continuously | Person-agent workflows need request-by-request trust decisions rather than broad implicit trust. |
| Recommendation — Verify the actor, request and context before each delegated action and re-evaluate trust continuously. | ||