Prince Mario-Max Schaumburg-Lippe: Who Vouches for an AI Agent?

Single sign-on solved a human problem. You log in once, prove who you are, and walk through a dozen doors at work without digging for another password. Now picture the worker is not a person at all. It is a software agent, hired by one company, knocking on the systems of another company, asking to read a file, book a meeting or move a payment. Who let it in? That question sits at the center of new work from WorkOS on agent-to-agent SSO and federation, and it is quickly becoming one of the most practical questions in enterprise AI.

The timing makes sense. Agents have stopped being chat windows. They schedule, they search shared drives, they open tickets and they talk to other agents to get jobs done. Each of those steps crosses a trust boundary. A human employee carries a badge, a manager and a paper trail. An agent, by default, carries an API key and a lot of confidence. That gap is exactly what identity teams are now trying to close, building on the momentum around Okta’s Agent SSO work highlighted in the AI Agent Store roundup on Oct. 20-21.

Who vouches for an agent?

Start with the simplest test. When a person from Company A visits Company B, federation lets B trust A’s login system. B does not need a second account for the visitor. It checks A’s proof, reads a few claims about the visitor, and decides what that visitor may do.

Agents need the same courtesy, with extra paperwork. It is not enough to know that an agent exists. The receiving system needs to know who built it, who deployed it, which human or team it acts for, and what it was asked to do. Think of it as a passport plus a letter of introduction. The passport says the agent is real and registered. The letter says why it showed up today.

That distinction matters in daily life. A support agent reading a help article is low risk. A procurement agent approving a purchase order is not. If both arrive with the same vague credential, the receiving company has to treat both as suspicious or both as trusted. Neither choice works for long. Good agent SSO splits identity into layers, so a system can welcome the reader and still double-check the buyer.

Readers who follow our coverage of the race to fund the biggest AI labs will recognize the pattern. Money and models get the headlines. Identity plumbing decides whether any of it can be used safely inside a real business.

How permissions delegate without getting lost

Delegation is the second hard problem, and it is sneakier than login. A manager asks an agent to plan a trip. That agent asks a second agent for flights, a third for hotel rates, and a fourth to check a calendar held by a partner firm. At each hop, the permission should shrink, not grow. The flight agent needs dates and a budget range. It does not need payroll data. The calendar agent needs free and busy times. It does not need the full contents of every meeting.

Short chains, short lifetimes

The cleanest designs borrow two habits from careful human offices. First, keep the chain short and named. Every hop records who handed off the task and what scope came with it, so there is no mystery agent in the middle. Second, keep credentials short-lived. A token that lasts ten minutes for one task is far safer than a standing key that works all quarter for anything.

WorkOS and others in this space also push for scoped, task-bound access. The agent does not get the user’s powers. It gets a narrow slice, for a stated purpose, with an expiry time. If the task changes, it asks again. That feels slower on paper. In practice it prevents the classic accident where an assistant hired to summarize email quietly gains the right to send it.

You can see the same lesson in physical automation. Our report on humanoid robots building robots at Schaeffler showed factories giving machines clear stations and clear limits. Software agents need the digital version of that discipline.

How actions get audited later

Auditability is the third leg, and it may be the one executives care about most. When something goes wrong at 2 a.m., nobody wants a shrug. They want a log that answers four questions in plain order. Which agent acted? On whose behalf? Under which permission? With what result?

A useful audit trail therefore records the full delegation chain, not just the final click. If Agent C booked the room, the log should show that a person approved the trip, Agent A split the task, and Agent B passed a limited booking right to C. Each step gets a timestamp and a signature the receiving system can verify later. No single company has to trust another company’s word alone. The records line up, or they do not.

That habit also helps when nothing goes wrong. Teams can spot agents that ask for too much access, vendors whose agents retry failed calls hundreds of times, and workflows where one slow approval blocks everything else. Good logs turn superstition into measurement.

What buyers should ask this quarter

If your company is testing agents that cross organizational lines, a few questions will save you grief. Ask how an agent proves its owner and deployer, not just its name. Ask whether permissions narrow at every delegation hop, and whether a person can revoke them mid-task. Ask to see a sample audit record from start to finish, including a failed attempt. The failed attempt matters. A system that only logs success is telling stories, not keeping records.

Ask about federation, too. Can the agent use your existing identity provider, the same one your staff already trust? Can a partner company set its own rules for what your agents may do on its turf? Local control is the whole point of federation. One side issues the proof. The other side still owns its doors.

The stakes will keep rising as agents negotiate with each other at machine speed. Coverage of Waymo bringing its robotaxis to Madrid is a useful reminder that autonomous systems earn trust city by city, permit by permit. Agent identity will grow the same way, company by company and connection by connection.

The bottom line for teams

Agent-to-agent SSO is not glamorous work. There is no demo where a login screen gets applause. But it is the work that lets everything else ship. Companies that can answer who vouched for an agent, how its permission was delegated, and how its actions were audited will move faster than rivals who are still sharing keys in chat threads. Start with one partner, one narrow task and a log you can actually read. That is how trust gets built, one verified handshake at a time.

Also published on: