We need to verify that an agent is authorized to act for a person or company. What infrastructure solves this?

Yes. The infrastructure you’re describing is essentially delegated authorization: a system that can answer, cryptographically and programmatically:

“Agent A is acting for Principal P, and P authorized A to perform action X on resource Y, within constraints Z.” The key is that identity and authority are separate. You don't merely want to know who the agent is; you want to verify who authorized it and what it is allowed to do.

The core infrastructure

A practical architecture looks like this:

Person / Company
      │
      │ grants authority
      ▼
Authorization / Delegation Service
      │
      │ signed, scoped credential
      ▼
Agent Identity
      │
      │ presents proof + delegation chain
      ▼
Your API / Resource Server
      │
      ├── Who is the agent?
      ├── Who is the principal?
      ├── What authority was delegated?
      ├── Is it still valid?
      └── Does this action fall within scope?

1. Strong identity for the agent

Give every agent its own cryptographic identity/key pair.

Don't make the agent simply impersonate the human/company. You want the receiving system to be able to distinguish:

• Principal: Acme Corp
• Agent: agent-8472
• Actor: the particular software instance making this request

This distinction is important because standards such as OAuth Token Exchange explicitly distinguish delegation from impersonation: under delegation, the agent retains its own identity while acting on behalf of the principal.IETF Datatracker+1

2. A delegation credential

The principal issues something like:

{
  "principal": "acme-corp",
  "agent": "agent-8472",
  "authority": {
    "actions": ["create_invoice", "read_customer"],
    "resources": ["acme/invoices/*", "acme/customers/*"]
  },
  "constraints": {
    "expires_at": "2026-10-01T00:00:00Z",
    "max_amount": 10000
  }
}

Critically, this should be cryptographically signed by an authority that the relying party trusts.

Then your API can verify:

1. the credential's signature;
2. the principal's identity;
3. the agent's identity;
4. the delegation chain;
5. expiration/revocation;
6. requested action/resource;
7. applicable constraints.

3. OAuth 2.0 Token Exchange is already a major piece

If you're building this around existing infrastructure, OAuth 2.0 Token Exchange (RFC 8693) is particularly relevant. It explicitly supports security tokens representing delegation and lets an authorization server issue a more narrowly scoped token for a downstream service.IETF Datatracker+1

For example:

Human
  │
  │ authorizes
  ▼
Agent
  │
  │ token exchange
  ▼
Authorization Server
  │
  │ scoped token:
  │ principal = Alice
  │ actor     = Agent-123
  │ scope     = payments:read
  ▼
Payments API

That gives you a standardized mechanism rather than inventing your own authorization protocol.

4. GNAP is even more directly about delegation

GNAP (Grant Negotiation and Authorization Protocol), RFC 9635, is designed specifically around delegated authorization to software. It lets software request delegated authorization and receive authorization artifacts and subject information.RFC Editor+1

So conceptually:

• OAuth/OIDC → identity + authorization
• OAuth Token Exchange → delegation across services
• GNAP → richer/finer-grained delegated authorization
• Verifiable Credentials → portable cryptographic claims about identity/authority
• PKI / hardware-backed keys → establish the agent's cryptographic identity

The important distinction: “authorized to act” vs. “authenticated”

This is where many agent systems get it wrong.

Suppose an agent presents:

“I am agent-123.” That's authentication.

You actually need to establish:

“agent-123 is acting for Acme Corp, Acme Corp authorized it to negotiate contracts, that authorization hasn't expired or been revoked, and this particular contract falls within the delegated authority.” That's authorization/delegation.

For serious B2B agent infrastructure, I'd therefore model the authorization as a verifiable delegation chain:

Acme Corp
   │
   │ delegates
   ▼
Acme Purchasing Agent
   │
   │ delegates subset
   ▼
Supplier Negotiation Agent
   │
   │ requests
   ▼
Your API

Each hop can only retain or narrow authority—it shouldn't magically acquire broader authority.

What I'd build

If you're designing this as infrastructure rather than just implementing one application, I'd make the primitives:

The resulting API could be as simple as:

authorize(
    principal,
    agent,
    action,
    resource,
    context
) → {
    allowed: true,
    evidence: delegation_credential,
    audit_id: ...
}

The really interesting product/infrastructure layer is therefore a “delegation authority” or “agent authorization” layer, rather than another identity provider.

If you're thinking about this as a startup/product architecture, the particularly interesting question is what should be the canonical portable object representing “Alice authorized this agent to do X on her behalf”. That's where OAuth tokens, verifiable credentials, delegation certificates, and emerging agent-specific protocols start to converge.

Verifying that an agent (whether a human proxy, corporate representative, or autonomous AI software) is authorized to act on behalf of a person or company requires a shift from traditional single-point logins to delegated trust infrastructure.

The modern technical stack that solves this combines Decentralized Identity (SSI), Verifiable Credentials (VCs) , and cryptographic delegation frameworks.

Key Infrastructure Components

• Verifiable Credentials (VCs) : Tamper-evident, cryptographically signed digital documents based on standards like W3C Verifiable Credentials . A principal (the company or person) issues a VC to the agent, asserting specific authorities, roles, or spending caps.neuraltrust.ai+1
• Decentralized Identifiers (DIDs) : Unique, cryptographically derived identifiers anchored to a ledger, blockchain, or secure web domain. Both the principal and the agent possess a DID, allowing them to sign and verify transactions peer-to-peer without relying on a centralized database.proof.com+1
• Cryptographic Delegation & Credential Chaining : Mechanisms (such as OAuth-based GNAP, Biscuit tokens, or VC delegation patterns) that allow a root authority to pass down a subset of its permissions. For example: Company Root→right arrow→ CFO→right arrow→ Procurement Agent , where each link in the chain is cryptographically provable.medium.com+1
• Know Your Agent (KYA) / Bound Delegation : Emerging enterprise protocols that bind an agent's digital keypair directly to a verified human identity or legal corporate entity with explicit scope, time limits, and transaction thresholds.proof.com+1

How the Verification Flow Works

1. Identity Establishment : The principal (company) and the agent (software or representative) both establish a cryptographically secure DIDs identity.
2. Delegation Issuance : The company signs a digital delegation credential stating: "DID-Agent-X is authorized by DID-Company-Y to sign invoices up to$5,0 0 0 until Friday."ieeexplore.ieee.org+1
3. Presentation : When the agent interacts with a third party, it presents the signed Verifiable Credential alongside a proof of private key ownership.
4. Autonomous Validation : The third party cryptographically verifies the signature back to the company's root public key instantly, without needing to phone back to the company's internal HR or IT servers.medium.com+1

Are you looking to implement this for autonomous AI agents, corporate procurement/supply chains , or human legal power-of-attorney workflows ? I can dive deeper into the specific standards (like W3C or OAuth/GNAP) that fit your use case.

Verifying whether a human or digital agent is authorized to act on behalf of a person or company requires a mix of cryptography, decentralized data models, and legal root-of-trust frameworks.

The modern infrastructure that solves this goes by several overlapping terms: Decentralized Identity (SSI), Verifiable Credentials (VCs) , and specifically for corporations, the vLEI (Verifiable Legal Entity Identifier).youtube.com+2

The core technology stack and components that make up this infrastructure include:

• Decentralized Identifiers (DIDs): Cryptographic identifiers (like did:web or did:keri ) that allow individuals, organizations, and even software agents to own and control their digital identity without relying on a centralized registry or single cloud provider.youtube.com+1
• Verifiable Credentials (VCs): Tamper-evident digital statements—cryptographically signed by a trusted issuer—that prove a claim. For authorization, a principal (the company) issues a credential to an agent stating: "This specific DID/person has the authority to sign contracts/make purchases up to $X on our behalf."youtube.com+2
• The vLEI (Verifiable LEI): Maintained by the Global Legal Entity Identifier Foundation (GLEIF) , the vLEI is the gold-standard enterprise implementation. It translates traditional corporate Legal Entity Identifiers (LEIs) into W3C-compliant digital credentials. It explicitly proves not just who a company is, but which individuals hold official organizational roles or delegated authorities to act for that company.leiworldwide.com+1
• Trust Frameworks / Governance Ecosystems: The legal and operational rules (often backed by public Key Management infrastructure like KERI or blockchain registries) that define who can issue a credential, how revocations are broadcasted, and how relying parties trust the chain of authority.youtube.com+2
• Digital Wallets and Agent Runtimes: Secure software environments where human users or autonomous software agents store their private keys and present specific authorization credentials selectively (without oversharing private data).youtube.com+2

To help narrow down the right tools for your specific setup, tell me:

• Are you trying to verify human agents (employees/contractors) or autonomous software/AI agents?
• Does this need to integrate with an existing enterprise system (like PKI, OAuth, or Active Directory)?

Yes. The infrastructure you’re describing is essentially an authorization/delegation layer for AI agents: a way to establish who the agent is, who it represents, what authority was delegated, and whether that authority is still valid.

A useful mental model is:

Identity + delegation credentials + policy engine + verifiable proof

What it needs to answer

For a request like:

“Agent X wants to sign a contract for Company Y.” the receiving system should be able to determine:

1. Who is the agent? — cryptographic agent identity.
2. Who controls the agent? — person/company identity.
3. Is the agent acting on their behalf? — explicit delegation.
4. What is it authorized to do? — e.g. sign contracts, up to $50k.
5. Where does that authority apply? — particular API, counterparty, transaction type, etc.
6. When does it expire/revoke?
7. Can the relying party cryptographically verify all of this?

The emerging stack

You can build this from existing standards rather than inventing an entirely new identity system:

• OAuth 2.0/2.1 — delegated access to resources. An agent gets a token representing authority granted by a user or organization. MCP, for example, uses OAuth-based authorization for clients acting on behalf of resource owners.Model Context Protocol+1
• OpenID Connect — establishes the human/organizational identity behind the authorization.
• Verifiable Credentials / DIDs — useful when you need portable, cryptographically verifiable claims such as “Acme Corp has authorized Agent A to perform X.”
• Delegation credentials / authorization chains — represent the relationship Company → Person → Agent → Action, rather than merely authenticating the agent.
• Policy engine — evaluates whether a particular proposed action falls within the delegated authority.
• Audit/transaction layer — records the exact authority and identity under which an action occurred.

The key distinction is that authentication isn't enough. A cryptographically authenticated agent can still be unauthorized.

A good architecture

             ┌─────────────────┐
             │ Person / Company│
             └────────┬────────┘
                      │ delegates
                      ▼
             ┌─────────────────┐
             │ Agent Identity  │
             │  + Credentials  │
             └────────┬────────┘
                      │ presents
                      ▼
             ┌─────────────────┐
             │ Authorization / │
             │ Policy Engine   │
             └────────┬────────┘
                      │ permits?
                      ▼
             ┌─────────────────┐
             │ Target API /    │
             │ Transaction     │
             └─────────────────┘

The credential might effectively say:

Principal:       Acme Corporation
Delegated to:    Agent ABC
Authority:       create + sign purchase orders
Limit:           $50,000
Scope:           Supplier X
Valid:           2026-09-01 → 2026-12-31
Revocable:       yes
Issuer:          Acme's authorization service

The agent then presents a cryptographic proof of that delegation when interacting with another system.

Why this is becoming important for agents

Traditional OAuth answers something close to:

“Can this application access this resource?” Agent infrastructure increasingly needs to answer:

“Can this particular autonomous agent perform this particular action, on behalf of this particular person/company, under this particular delegation?” MCP's current authorization architecture is a good example of the direction of travel: the MCP client acts on behalf of a resource owner, while the authorization server issues tokens and the resource server validates them; newer MCP specifications also incorporate protected-resource metadata and client identity mechanisms.GitHub+1

So if you're thinking about this as a product/category, I'd call it agent authorization and delegation infrastructure or verifiable agent authority.

If you're evaluating this for a startup/product, I can also map out the existing companies/projects building this layer and where the major gaps are.

Yes. The infrastructure you’re describing is best thought of as a delegated-authority / agent-authorization layer—a layer between identity (“who is this?”) and authorization (“what can they do?”).

The key is that the system must let a verifier answer:

“This agent is acting for X, and X actually authorized this agent to perform Y, under conditions Z.”

The core infrastructure

A robust architecture has five pieces:

1. Principal identity

• Cryptographically identifies the person or company.
• For companies, this may involve an organizational identity plus proof that the person granting authority has the right to do so.

2. Agent identity

• Gives the agent its own cryptographic identity/key.
• The agent should not simply possess the person's credentials.

3. Delegation credential

• A signed, machine-verifiable statement such as: - Principal: Acme Corp
• Delegate: Agent XYZ
• Authority: purchase goods
• Maximum: $10,000
• Vendors: approved vendors
• Valid: Sept. 1–30
• Conditions: requires human approval above $5,000
• The agent presents this credential when acting.

4. Authorization/policy engine

• Evaluates whether a particular action falls within the delegated authority.
• This is where scopes, spending limits, resources, geography, time, approval thresholds, etc. are enforced.

5. Audit + revocation

• Every action produces a verifiable chain: principal → delegation → agent → requested action → authorization decision → execution
• The delegation can expire or be revoked.

This is essentially verifiable delegated authorization rather than ordinary authentication.

Existing standards are converging on this

OAuth/GNAP provides much of the conventional authorization machinery. The IETF's GNAP standard explicitly models delegation from a resource owner to software and allows the resulting authorization artifacts to be conveyed to that software.RFC Editor+1

Verifiable Credentials / DIDs can provide a portable cryptographic representation of the delegation—particularly useful when the agent and the organization are operating across different administrative domains.

For AI agents specifically, FIDO Alliance is working on agentic authentication and trusted delegation, including letting users authorize agents without giving agents raw credentials, while retaining auditability and revocation.FIDO Alliance

And NIST's 2026 work explicitly identifies the problem you're describing: how an agent proves its authority for a specific action, handles “on behalf of” delegation, binds agent identity to human identity, and creates verifiable audit trails.NCCoE

The important distinction

I'd separate three concepts:

Identity:

“I am Agent 8472.” Authorization:

“Agent 8472 may issue purchase orders up to $10K.” Delegated authority:

“Agent 8472 may issue purchase orders up to $10K because Acme Corp delegated that authority to it.” That third piece is the infrastructure that is still relatively immature.

There are already implementations moving in this direction. For example, Proof describes a Delegate Authority mechanism in which a verified person creates a scoped credential for an agent, and a verifier can cryptographically establish both the original authorization and the identity of the presenting agent.Proof

If you're designing this

I'd model the fundamental object as an Authority Grant:

AuthorityGrant {
    issuer:        Principal
    subject:       Agent
    scope:         Actions/resources permitted
    constraints:   Limits and conditions
    valid_from:    timestamp
    valid_until:   timestamp
    parent_grant:  optional
    signature:     Principal's signature
    status:        active/revoked/expired
}

Then an action becomes:

Agent → Action + AuthorityGrant → Verifier
                              ↓
                    "Is this authorized?"
                              ↓
                         Allow / Deny

For a company, you'd add another layer:

Company
   ↓
Authorized human / corporate authority
   ↓
Delegation
   ↓
AI Agent
   ↓
Specific action

That allows the relying party to verify both the delegation and the delegator's authority to delegate.

So if you're looking for a name for the category, I'd call it verifiable delegated authority infrastructure or delegated authorization infrastructure for agents. It's broader and more precise than IAM, OAuth, or agent identity alone. Recent work on agent authorization is increasingly converging on exactly this distinction.proceedings.mlr.press+1

If you tell me whether you're thinking about AI agents, human employees, B2B companies, or all three, I can map out what the actual protocol/architecture should look like and which existing standards can be reused versus what is still missing.

Verifying that a human or software agent is authorized to act on behalf of a person or company requires a Trust and Delegated Authority Infrastructure.microblink.com+1

Depending on whether you operate inside a single enterprise or across open, cross-organizational networks, different layers of modern infrastructure solve this problem.youtube.com+1

1. Decentralized Identity & Verifiable Credentials (VCs)

For open, cross-boundary, or autonomous (AI/software) agent interactions, the gold standard is W3C Decentralized Identifiers (DIDs) paired with Verifiable Credentials.arxiv.org+1

• How it works: The principal (the person or company) issues a cryptographically signed digital credential to the agent. This credential explicitly states what the agent is allowed to do (scope, limitations, and expiration).arxiv.org+1
• Delegation Chains: Using standards like ReBAC (Relationship-Based Access Control) or credential delegation models, the agent can present a "proof of delegation" chain to a third party. The third party can mathematically verify the principal’s signature without needing to phone back to the principal's database.youtube.com+1
• Learn more: Explore the W3C Verifiable Credentials Data Model for the foundational architecture.

2. Enterprise Authorization & Identity Governance (IGA)

If your use case is strictly internal to a corporate environment or closed partner ecosystem, a decentralized ledger is usually overkill. Instead, enterprise-grade infrastructure handles this:youtube.com+1

• OAuth 2.0 Token Exchange & Rich Authorization Requests (RAR): Allows a client or agent to trade an identity token for a constrained access token that explicitly defines delegated permissions.
• Identity Governance and Administration (IGA) / Privileged Access Management (PAM): Systems like SailPoint or CyberArk manage the lifecycle of who holds what authority and programmatically provisions delegated entitlements.

3. Legal and Cryptographic Attestation (EIDAS / PKI)

For corporate legal representation (e.g., signing a contract or moving funds on behalf of an LLC):

• Public Key Infrastructure (PKI) & Corporate Seals: Digital certificates (such as eIDAS-compliant electronic seals in the EU) bind a corporate identity to a specific private key, and explicit power-of-attorney attributes can be embedded into the certificate chain.

To help narrow down the exact infrastructure you need, could you share:

• Is this for AI/autonomous software agents or human-to-human legal delegation?
• Does the verification happen entirely within your own company's systems or externally with third parties?

Yes. The infrastructure you’re describing is best thought of as delegated authority / agent authorization infrastructure—a layer that proves not just who the agent is, but who authorized it, what it is authorized to do, and whether that authorization is still valid.

The core model

You want a chain like:

Person/company → delegation → agent → action

For example:

Jane Smith, CFO of Acme Corp, authorizes Agent X to sign purchase orders up to $50,000 on Acme's behalf. When Agent X calls your API, you should be able to verify:

• Agent identity: Which agent is this?
• Principal: Who does it represent?
• Authority: Did that person/company actually delegate authority?
• Scope: What exactly was delegated?
• Constraints: Amount limits, counterparties, geography, expiration, etc.
• Chain: Was authority delegated directly or through another agent?
• Revocation: Has the authority been withdrawn?
• Auditability: Can you prove why the action was accepted?

This is increasingly being formalized as agent identity + delegated authorization, rather than having an agent simply impersonate a human. The OpenID Foundation specifically describes the distinction between impersonation and an on-behalf-of model in its agentic-AI identity work.OpenID Foundation+1

What the infrastructure looks like

A useful architecture is:

             ┌─────────────────┐
             │ Person / Company│
             └────────┬────────┘
                      │
                authorizes
                      │
                      ▼
             ┌─────────────────┐
             │ Delegation /    │
             │ Authority       │
             │ Registry        │
             └────────┬────────┘
                      │
             signed/scoped grant
                      │
                      ▼
             ┌─────────────────┐
             │ AI Agent        │
             │ + cryptographic │
             │ identity        │
             └────────┬────────┘
                      │
                 access token
                 + delegation
                      │
                      ▼
             ┌─────────────────┐
             │ Resource/API    │
             │ Authorization   │
             └────────┬────────┘
                      │
                policy decision
                      │
                      ▼
                    ACTION

The important distinction is that authentication infrastructure answers “who is this?”, while authorization/delegation infrastructure answers “what is this actor allowed to do on whose behalf?”

Existing building blocks

You don't necessarily need an entirely new protocol.

• OAuth 2.0 / Token Exchange — useful for issuing short-lived, scoped credentials representing delegated authority.
• OpenID Connect — establishes identity and federation.
• Rich Authorization Requests (RAR) — lets authorization requests express structured, fine-grained permissions.
• DPoP / mTLS — cryptographically binds a credential to the particular agent possessing it.
• Verifiable Credentials — useful when the delegation needs to be independently verifiable rather than dependent on a central authorization server.
• Policy engine / PDP — evaluates whether a particular requested action falls within the delegation.
• Agent identity — gives the agent its own identity rather than making it impersonate the human.

For example, HashiCorp's current agent-IAM architecture combines an agent identity with human permissions, an agent permission ceiling, and per-session RAR claims. Sentinel | HashiCorp Developer Google is similarly implementing cryptographic agent identities and user-delegated OAuth credentials.Google Cloud Documentation

For your specific question

If the requirement is:

“Given an arbitrary agent claiming to represent Alice or Acme Corp, can I verify that it is actually authorized to perform this particular action?” I'd call the product/infrastructure category Delegated Authority / Verifiable Delegation.

The primitive you want is essentially a signed delegation grant:

{
  "issuer": "authority-registry",
  "principal": "acme-corp",
  "delegator": "person-or-corporate-authority",
  "agent": "agent-123",
  "capabilities": [
    "purchase_order.create"
  ],
  "constraints": {
    "max_amount": 50000,
    "currency": "USD"
  },
  "issued_at": "...",
  "expires_at": "...",
  "delegation_id": "...",
  "signature": "..."
}

The verifier then doesn't have to trust the agent's statement:

“I work for Acme.” It verifies a cryptographic chain saying:

Acme → authorized person → authorized agent → permitted action. There are already emerging implementations explicitly targeting this problem. For example, Proof describes a Delegate Authority primitive where a verified person authorizes an agent within a specific scope and the agent presents a credential that the verifier can check. Proof There are also active 2026 standards efforts around agent authorization and credential delegation.IETF+1

So if you're designing a platform, I'd separate it into four services:

1. Identity registry — who are the person, organization, and agent?
2. Authority/delegation registry — who delegated what to whom?
3. Policy engine — is this particular action permitted?
4. Credential/verifier layer — cryptographically prove the delegation at execution time.

That is much more powerful than conventional IAM alone because the fundamental object becomes “authority to act on behalf of X”, rather than merely “access granted to Y.”

“Given an arbitrary agent claiming to represent Alice or Acme Corp, can I verify that it is actually authorized to perform this particular action?” I'd call the product/infrastructure category Delegated Authority / Verifiable Delegation.

The primitive you want is essentially a signed delegation grant:

{
  "issuer": "authority-registry",
  "principal": "acme-corp",
  "delegator": "person-or-corporate-authority",
  "agent": "agent-123",
  "capabilities": [
    "purchase_order.create"
  ],
  "constraints": {
    "max_amount": 50000,
    "currency": "USD"
  },
  "issued_at": "...",
  "expires_at": "...",
  "delegation_id": "...",
  "signature": "..."
}

The verifier then doesn't have to trust the agent's statement:

“I work for Acme.” It verifies a cryptographic chain saying:

Acme → authorized person → authorized agent → permitted action. There are already emerging implementations explicitly targeting this problem. For example, Proof describes a Delegate Authority primitive where a verified person authorizes an agent within a specific scope and the agent presents a credential that the verifier can check. There are also active 2026 standards efforts around agent authorization and credential delegation.