Identity, authorisation and evidence: three different questions

When an AI agent acts on someone's behalf, three questions matter, and they are answered by different layers that are often confused.

Who stands behind this agent? That is identity. Protocols and providers in this layer bind an agent to a person or organisation, sometimes with government-grade identity proofing. One example is x401, an open protocol that lets a service ask an agent for cryptographic proof of the verified human behind it before proceeding.

What is it permitted to do? That is authorisation. It is established at the moment of an action: a credential, an approval, a scoped grant. The identity layer and the authorisation layer together answer "may this agent do this, on whose authority" at a point in time.

What did it actually do? That is evidence, and it is a different question with a different shape. It is continuous rather than momentary. It covers the actions nobody thought to gate, the tool calls outside the declared scope, the approvals that were and were not sought, and how all of it changed as the agent evolved. It is the question a buyer, a security reviewer or an auditor asks after the fact, and it is the question a proof room exists to answer.

The layers are complementary. An authorisation credential presented at the moment of an action is strong evidence about that moment, and a record of actions is what gives an authorisation its context: what happened before it, after it, and without it.

A short way to hold the distinction: identity proves who, authorisation proves may, evidence proves did.

Related pages

• Evidence levels
• What an AI agent audit trail should contain
• Absence of evidence

Honesty notice

This page is general information, not legal or compliance advice. Framework references indicate topical mapping, not certification or compliance.