Intent passports for AI agents: what identity alone misses

At a glance

What this is: This article argues that AI agent governance needs an intent passport model because identity alone cannot express purpose, duration, data scope or behavioural constraints.

Why it matters: That matters because IAM, NHI and AI governance teams need controls that govern what an agent is authorised to do, not just what account it uses.

Context

AI agent governance fails when identity is treated as the full answer to authorisation. In this model, an account tells you who or what is acting, but not why it is acting, how long permission should last, or what data and decisions sit inside the approved boundary. That is the gap this article addresses for NHI and agentic AI programmes.

The article proposes an intent passport as the missing control layer: a machine-readable declaration of purpose, data scope, time window, risk level, safety filters, logging requirements and revocation rules. In practice, that shifts governance from static assignment to bounded machine action, which is why this topic sits at the intersection of IAM, NHI lifecycle and AI governance.

Key questions

Q: What breaks when directory identity is treated as enough for AI agent authorisation?

A: Directory identity breaks as a governance boundary when teams assume registration and standing scopes are sufficient for dynamic agent behaviour. The agent may be known to the directory but still make request-by-request decisions that need separate policy. That creates over-broad access, weak auditability, and the wrong trust model for delegated execution.

Q: Why do AI agents need intent-based authorization instead of role-only access?

A: Role-only access answers who the actor is, but not whether the action still matches the reason access was granted. Intent-based authorization closes that gap by evaluating purpose, task context, and resource sensitivity at runtime. For agentic systems, that is the difference between bounded delegation and open-ended capability reuse.

Q: How do security teams know whether agent permissions are still valid?

A: They should look for expiry, logging and revocation tied to the original task. If the workflow has changed, the data boundary has expanded or the agent is still operating after the authorised window, the permission is no longer valid. The test is whether the control follows the mission, not whether the account still exists.

Q: What is the difference between an AI agent’s identity and its intent passport?

A: Identity identifies the actor. An intent passport defines the actor’s authorised behaviour, including purpose, data scope, time window, risk level and revocation rules. One answers who is acting, while the other answers what that actor may do, under what conditions and for how long. They solve different governance problems.

Technical breakdown

Why identity is insufficient for AI agents

Identity is a descriptor, not a behavioural contract. For humans, identity often correlates with job role, expected purpose and review cadence, but AI agents can initiate actions from signals, models or other agents without revealing why a decision is happening. That means a valid authentication event does not tell you whether the agent is operating within its intended mission, data boundary or risk tolerance. In NHI terms, the account is necessary but not sufficient: the control problem is not access alone, it is authorised behaviour across time and context.

Practical implication: Practitioners must separate account issuance from behavioural authorisation and treat purpose, scope and duration as distinct governance inputs.

What an intent passport encodes

An intent passport is a structured authorisation record that binds a machine actor to a specific task boundary. The article breaks that boundary into principal, purpose, data scope, time window, risk level, safety and policy filters, logging requirements and revocation rules. That is materially different from a role assignment because it expresses not only what access exists, but the conditions under which access remains valid. For AI agents, this creates a governance artefact that can be evaluated, logged and revoked as the task changes.

Practical implication: Use intent metadata as part of agent onboarding so policy teams can approve or deny machine actions before they run.

Why logging and expiry become governance controls

Agent behaviour moves faster than human review cycles, so post-hoc oversight alone cannot contain risk. Logging becomes the accountability layer because it preserves decision trails, while expiry prevents permissions from persisting beyond the approved intent. In agentic systems, these are not administrative details. They are the controls that let organisations reconstruct why an action happened, prove that the action was bounded and withdraw authority when the mission ends or drifts.

Practical implication: Tie every high-impact agent workflow to traceable logs and automatic expiry so permissions do not outlive the approved use case.

Threat narrative

Attacker objective: The objective is not a conventional intrusion but uncontrolled machine action that exceeds the intended governance boundary and creates business, privacy or brand harm.

1. Entry occurs when an AI agent is granted a valid identity and begins operating inside a workflow with standing permissions tied to that account.
2. Escalation happens when the agent continues acting beyond the original task boundary, because the identity record does not constrain purpose, timing or decision latitude.
3. Impact follows when the agent uses approved access in ways that violate brand, privacy or compliance boundaries, and the resulting actions are difficult to explain after the fact.

Breaches seen in the wild

• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Intent is the missing control plane for AI agents: identity tells us who the actor is, but not what the actor is authorised to do in the moment. That matters because agentic systems can consume signals, choose actions and continue operating after the initial task context has changed. Practitioners should treat intent as a first-class governance object, not a policy footnote.

Purpose-binding is the broken assumption in agent governance: traditional IAM assumes authorisation can be inferred from role and identity at provisioning time. That assumption fails when an agent’s mission, data use and risk posture can shift inside the session. The implication is that access decisions must be bound to declared intent, not only to the account that holds the token.

Time-bound machine authorisation is now a lifecycle requirement: long-lived permissions create drift between the approval event and the actual machine behaviour. The article’s revocation and expiry logic points to a broader governance truth: agent permissions need lifecycle controls that end with the task, not with the calendar. Practitioners should design for expiry as the default state.

Brand safety, privacy and AI integrity now converge in one governance problem: the same agent can influence spend, customer experience and data handling in the same workflow. That convergence means marketing, privacy and security leaders can no longer treat agent oversight as separate programmes. The practical conclusion is that cross-functional ownership is mandatory wherever agents shape externally visible decisions.

Intent passport governance defines the next NHI boundary: as non-human identities scale, the field needs language that separates authentication from behavioural authority. The article’s model is a useful named concept because it captures the real control gap: permission to act is not the same as permission to pursue an outcome. Practitioners should use that distinction when defining agent governance standards.

From our research library:

• 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
• Read next: Agentic AI Identity Guide

What this signals

Intent passport governance: AI programmes need a control layer that binds machine action to declared purpose, time window and data scope. Without that layer, identity becomes a label rather than a boundary, and governance teams lose the ability to tell whether an agent is still operating inside the approved mission.

Access review processes are too slow to govern agents that act continuously, so the control point has to move toward issuance, expiry and revocation. That is where NHI lifecycle discipline and AI governance begin to converge, especially when agents influence customer journeys, spend or sensitive data handling. According to the 2026 Infrastructure Identity Survey, only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.

For practitioners

• Define intent-bound authorisation for agent workflows Map each high-impact agent use case to a declared purpose, data scope, time window and escalation condition before it is allowed to run.
• Make logging the accountability layer Require traceable decision trails for every customer-facing or spend-influencing agent so teams can reconstruct what happened and why.
• Set automatic expiry on agent permissions Treat every intent passport as temporary and withdraw access when the task ends, the context changes or the risk level increases.
• Govern agents across marketing, privacy and security Build a shared review path for workflows that affect brand safety, personal data use and AI integrity so controls do not split by department.

Key takeaways

• AI agent governance fails when organisations treat identity as the full authorisation model instead of a starting point for control.
• The article’s core contribution is the intent passport, which binds purpose, data scope, time window and logging to machine behaviour.
• Practitioners should shift from static access assignment to task-bounded machine authorisation with expiry and revocation built in.

Key terms

• Intent Passport: A machine-readable governance record that describes what an AI agent is allowed to do, why it is acting, what data it may use, how long the permission lasts and how the authority is revoked. It turns behavioural constraints into a controllable policy object.
• Purpose Binding: The act of tying an identity to a specific mission, approved scope, and accountable owner before access is granted. For autonomous actors, purpose binding is critical because it gives auditors and administrators a reason the identity exists and a boundary for what it may do.
• Behavioural Authority: The portion of governance that describes what an actor is allowed to do in practice, not just what account it holds. For AI agents, behavioural authority must be constrained separately from identity because the same identity can drive different actions across time and context.
• Time-Bound Permissions: Time-bound permissions are access rights that remain valid only for a defined period. They are used for contractors, reviewers, vendors, and project-specific collaboration where access should end predictably. The core benefit is reducing standing privilege while keeping temporary sharing operationally practical.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.