Hire Your Agent, Don't Give It Your Credentials

Current AI agents usually run with the user's full credentials, impersonating the user for every action. This eliminates per-agent audit trails, prevents fine-grained revocation, and creates a large blast radius if any agent is compromised. Any agent with Gmail or API access inherits all user privileges.

The protocol gives each agent its own identity via a private key, discovery through a well-known endpoint and capability directory, and fine-grained capabilities instead of coarse OAuth scopes. This shifts from 'act as me' to 'act for me within defined limits,' enabling per-agent logs, revocation, and host-level policies.

The reference implementation converts existing OpenAPI specs into agent capabilities and uses an MCP proxy to bridge until services adopt the protocol natively. A demo shows an agent requesting email read access, user approval via device flow, and immediate blocking upon revocation. Long-lived agents, policy inheritance, and fleet management are missing but planned for V2.

For engineering leaders, the takeaway is not to adopt this specific draft immediately but to recognize that agent identity and governance will become a non-negotiable requirement as agents move from ephemeral experiments to persistent production actors. Waiting until a security incident forces the conversation is the wrong strategy.