The Missing Link in the Agentic State aka Solving the AI Identity Crisis in Public Services
We have the tool layer, but lack the authorization layer. Here is how architecting the triad of Person, Agent, and Scope creates a trust anchor for the proactive Personal State.
We are crossing the threshold into the “post-digital” era, transitioning from a reactive digital government to a proactive Personal State. In this paradigm, AI is no longer a passive conversational tool, but an autonomous agent capable of executing complex transactions on our behalf. However, as we build this future, a critical architectural gap has emerged: we have the tool layer, but we lack the authorization layer.
The Impersonation Trap
Today, when an AI agent interacts with a service, it effectively impersonates the user. Current experimental integrations, such as public betas connecting AI tools to banking services via Smart-ID, rely on broad, static tokens that name the person, not the agent. These tokens lack purpose codes, rely on service-provider-specific revocation, and are inherently limited to read-only actions to mitigate risk. This creates a fragmented ecosystem where every service provider builds their own point-to-point trust model (the classic M×N problem), obscuring the chain of responsibility.
Architecting the Triad: Person, Agent, and Scope
To move forward, the state must act not as a transactional middleman, but as a universal trust anchor. The solution lies in a new generation of identity management, conceptualized as “TARA 2.0”, which assigns a unique identifier to the AI agent itself.
This framework replaces broad access with a highly granular, three-tiered consent model:
- Binding
A one-time cryptographic linkage between the citizen’s eID and their chosen agent. - Persistent Authorization
Bounded, automated execution for low-risk, routine tasks, continuously verified against strict limits without bothering the user. - Explicit Signature
For high-stakes or write-actions, the agent must halt and route a “What You See Is What You Sign” (WYSIWYS) request directly to the user. This bypasses the agent entirely, requiring manual cryptographic approval.
The underlying authorization token (utilizing standards like SD-JWT VC) must explicitly name three distinct entities: the person, the agent, and the precise authorization scope (RFC 8693). When a strict limit is imposed, the strictest boundary, whether set by the service provider’s threshold or the user’s personal threshold, must always win.
Tomorrow’s Infrastructure
By adopting an X-Road-style architectural pattern, the central state infrastructure remains out of the data path, providing only the critical authorization registry and a decentralized, downloadable revocation state list. This empowers citizens with a centralized data-tracker, offering absolute transparency over what their agents are authorized to do across the entire ecosystem.
To make this a reality, we must also ensure our digital infrastructure is machine-readable. Implementing AI SEO and standardized capability registries will allow these authorized agents to seamlessly discover and interact with public services.
The legal and technical groundwork we lay today will define our readiness for the widespread deployment of autonomous systems. We need clear legal frameworks that recognize the agent as an authorized actor, ensuring a clear distribution of liability when an agent operates within its valid bounds. By separating the actor from the embodiment, we can build a proactive state that scales intelligently while preserving absolute citizen trust and control.
While we prepare our cryptographic defenses for the quantum era, we must simultaneously architect our legal and digital foundations for the arrival of AGI and autonomous humanoids.
