The problem it solves
Today, many AI tools reach business systems by borrowing a person’s identity. The AI signs in as Sarah, so every system sees Sarah. That is simple, but it means:
- The system cannot tell whether Sarah or her AI made a change.
- Rules cannot differ for Sarah and for her AI, even though they probably should.
- Turning off the AI means revoking Sarah’s own access, or hunting down a token.
- The audit trail says “Sarah” for everything.
AI agent identity addresses this by giving the agent its own recognisable identity, linked to, but distinct from, the person.
Three identities in one request
When an AI agent acts at work, there are usually three parties:
- The person, who asked for the work and is accountable for it.
- The agent, such as a particular Claude connection, a ChatGPT workspace or a scheduled workflow.
- The organisation, whose data and policies apply.
A good system knows all three on every request: Sarah’s Claude, acting for Sarah, inside ABC Practice.
What agent identity enables
- Specific rules. Sarah may send email; Sarah’s AI may only draft it.
- Clear audit. Records show that the agent acted, on whose behalf.
- Individual revocation. Disconnect one agent without touching the person’s account or other agents.
- Different agents, different trust. A coding agent and an email assistant can be treated differently even for the same person.
- Accountability. Every agent action traces back to a responsible person.
How identity is established
Approaches vary, and practice is still developing:
- Delegated sign-in. The person signs in through an identity provider such as Microsoft Entra ID and authorises an application. The application acts for them, limited to what they can access.
- Service identities. Background agents may use their own service accounts or application registrations, with their own credentials.
- Gateway-issued identity. A gateway identifies each connected AI client and ties it to the person who connected it.
Whichever you use, avoid shared credentials. If several agents or people use one key, you cannot tell them apart.
Identity is not permission
Knowing who an agent is does not decide what it may do. Identity answers “who are you?” Permissions, delegation and policy answer “what may you do, for whom, on what?” Both are needed.
Questions to ask of any AI tool
- Can our systems distinguish this AI’s actions from the person’s?
- Can we restrict the AI more tightly than the person?
- Can we switch off this one agent on its own?
- Does the record show the agent and the person?
How Kroy approaches it
Kroy identifies the person and the agent separately on every request. The person signs in, for example through Entra ID; the AI client connects as a distinct agent linked to them. Policies and delegations can apply to the agent specifically, audit records name both, and an agent can be disconnected without affecting the person’s own access.