Topic starter
14/09/2026 10:09 am
TL;DR: Delegated identity verification is a distinct risk for AI agents, because valid credentials do not prove who initiated the request, according to Trusona. Human verification has to stay separate from agent authorisation in resets, recovery, and privileged changes.
Editorial analysis by NHI Mgmt Group, based on content published by Trusona: “Your AI agent is about to act for someone. Who checked that someone?”.
Key questions
Q: Why do AI agents make help desk impersonation risk worse?
A: Agents remove the human hesitation that sometimes interrupts a suspicious request and they scale the attacker’s reach beyond a single phone call.
Q: How do security teams know if their verification controls are actually working?
A: They work if high-risk requests cannot be completed through a single channel and if helpdesk or approval attempts leave a clear audit trail.
Q: What breaks when AI agents can act without a verified human behind them?
A: Fraud and IAM controls lose attribution.
Practitioner guidance
- Define which delegated actions require human identity verification Map agent-performed actions that can change authentication state, access scope, or recovery paths, and require an authoritative identity check before execution.
- Separate agent authorisation from requester proofing Document where the agent’s token authorises execution and where a separate control proves the human behind the request.
- Require machine-readable verification results Use verification outcomes that the agent can consume as pass, fail, or risk signals, rather than human-readable pages or free-text evidence that the workflow must interpret.
Bottom line: AI agents can inherit authority without inheriting any way to verify the human behind a request, which makes delegated execution a distinct identity risk.
Glossary terms: Delegated Identity Verification, Agentic Proxy Action, Authoritative Identity Source, Verification And Authorisation Separation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 hours ago by NHI Mgmt Group
14/09/2026 10:10 am
Delegated identity verification is a separate control from delegated authorisation. An agent can be perfectly scoped and still faithfully carry out an impersonated request because the software identity and the human identity are being conflated. The industry keeps overloading NHI hygiene with a problem it cannot solve. The implication is that agent workflows need a human-verification layer, not just a better inventory of tokens.
A question worth separating out:
Q: Should teams treat agent credentials and human identity verification as the same control?
A: No. Agent credentials answer whether the software may act, while human identity verification answers whether the person behind the request is genuine. Those are different controls with different failure modes, and collapsing them creates a blind spot in delegated workflows that handle resets, recovery, or privileged changes.
👉 Read our full editorial: AI agents need human identity verification, not just credentials