The New Knock on Our Digital Front Door

I've heard some great stories from people we work with in healthcare about how AI is changing their lives. Doctors love the new in-ear systems that brief them on a patient while they walk to the exam room. Nurses like the ambient tools that capture the conversation automatically so they can talk to people instead of typing the whole time.

On the patient side, there's something remarkable happening. We now all have a personal chief medical officer in our pocket. In January, OpenAI reported that more than 40 million people ask ChatGPT healthcare questions every day. People can upload a photo of their weird rashes and get help making sense of it. It's free, always available and never gets tired of talking about you (or your sick kids). It's awesome.

The natural next question is this, what happens when I, as a patient, go to see my  doctor in real life and the AI on my phone already knows more about me than the doctor? The natural answer is, I want my AI to talk to my doctor's AI. What an unlock that would be for patient care.

However, to make that work, our identity systems need to recognize agents as agents. How does the doctor's AI know that my AI actually belongs to me? Sharing my health information with an impostor AI could violate HIPAA and put patients at risk. 

My agent is not me

The same questions apply everywhere. An AI shows up at an airline to change my ticket, how does the airline know it represents me? An AI asks my bank to see my records. You get the idea.

Some agents don't even arrive as separately authorized agents. They just use our identity. Meta's recent Muse release has been adopted by millions in just a few weeks. Muse takes the astonishing step of asking a user to log into a site in the browser and then Meta takes over the session from there and uses the human's identity without any other indication it's Muse driving.  Claude in Chrome and other agents do the same thing. The website authenticates the human's account, with no built-in way to understand an agent is driving.

  ​The digital front door that works is not another app. It is an identity layer that covers people and the agents they authorize.   

An agent publisher may promise safeguards. But this is preposterous cybersecurity. "Trust me and give me your credentials, don't worry" is not in any acceptable CISO playbook. Sites cannot build security around promises from whoever wrote the software knocking on their door.

When an agent operates inside my logged-in session, it can inherit permissions far beyond the task I gave it. Asking it to check my balance is not permission to move my money. The bank needs to identify the agent, verify my grant and enforce its limits independently of the agent's publisher. Those controls need to hold even when the agent or its publisher, cannot be trusted.

We've spent decades separating identities, limiting permissions and keeping track of who did what. Allowing agents to borrow a human's session undoes all three. At agent speed, that is going to break down. 

OAuth alone is not enough

Some sites are starting to solve this by using OAuth grants. Most of today's MCP servers work this way. OAuth is useful. It lets me give an application access without handing over my password. But today's common pattern of app-level grants is not enough. In that model, the system sees an authorized application, not necessarily the individual agent or the chain of authority behind it. OAuth does not automatically provide an agent's identity and reputation across different organizations. It's hard to imagine once this comes to scale humans making tens of OAuth grants to different agents all week just to let agents work for them.

Instead, agents need their own identity. That agent identity has to carry reputation with it. Systems need to track how an agent has behaved before and identify bad agents quickly. The human needs an explicit grant tied to that individual agent saying exactly what it is allowed to do. Letting my AI read lab results is not blanket permission to share them with another AI. That distinction has to survive when one agent delegates work to another.

Agent identity will become infrastructure

I've spent my career making painful back-end business processes work. Online banking in the ‘90s. Expense reporting in the 2000s and sales tax in the 2010s. Identity is next and this time it has to cover agents as well as people.

The good news is that the industry is starting to build the missing layer together. KYA-OS, being developed at the Decentralized Identity Foundation, defines cryptographic identities for agents and explicit, scoped, revocable delegation. Every action can carry verifiable proof of who acted and under whose authority. OAuth can remain part of that infrastructure. But granting access to an app is not the same as establishing trust in an agent.

Once an agent has a stable identity, reputation can travel with it. A good reputation can reduce friction. It cannot expand the permission I gave. An agent that tries to exceed its explicit grant can be throttled or rejected. The human stays in control.

The digital front door that works is not another app. It is an identity layer that covers people and the agents they authorize. We still need to know the agents walking through our doors, what grants the human gave them and whether their reputation warrants our trust.  

The good news is the standards are coming into place. We as an industry have a lot of work to do to make agent identity work at global scale.