Podcast: Securing AI Agents: Identity, Authorization, and the DPACT Framework

Sahil Agarwal · podcast · 2026-09-23 source ↗ Reader 🖥️

Agent Governance (Internal)Agent Identity & Attribution Agent Security Delegated Authority Grants (Bounded Task Grants)Guardrails Human-in-the-Loop Secrets Hygiene

As AI agents shift from passive chat interfaces to autonomous 'delegated actors' that take real, consequential actions with sensitive data, organizations must replace broad, human-shaped, long-lived tokens with the DPACT framework — Delegation, Policy, Auditability, Context, and Time — so that every agent acts strictly on behalf of, and never as an impersonation of, an accountable human principal, within a bounded, auditable, expiring grant of authority, adopted incrementally rather than as a big upfront program.

practical · mixed — An interview (InfoQ Podcast host Olimpiu Pop with Sahil Agarwal, a Dropbox engineering leader building AI-agent identity/authorization systems) that argues for adopting a specific framework (DPACT) and a specific incremental adoption path — practical throughout, delivered conversationally with anecdote-driven evidence rather than formal argument.

Structure

Part	Role
Framing the shift: agents as delegated actors, not chat windows	context
Core principle: agents must act 'on behalf of' a human, never impersonate them; why the pre-agent human-in-the-loop identity model breaks	premise
The DPACT framework itself — Delegation, Policy, Auditability, Context, Time — presented as a positional blueprint, not a tool	core content
Mapping DPACT to product decisions: autonomy tiers, the customer-service refund example	application / evidence
Two incident anecdotes (hiring/interview bot, food-ordering bot) where prompt injection broke unguarded agents	narrative evidence
The incremental adoption path: inventory -> visibility -> separate agent identity -> review high-impact actions -> continuous authorization	practical roadmap / conclusion
A call to IAM vendors and tool providers: first-class on-behalf-of grants, validated grants, structured audit events; the shift from 'a key' to 'a bounded task grant'	forward-looking conclusion
Closing babysitter/nanny analogy	narrative reinforcement of unity

Key terms

DPACT
Agarwal's five-pillar framework — Delegation, Policy, Auditability, Context, Time — specifying the minimum categories of guardrail an agentic system needs: on whose behalf the agent acts, what it can/cannot do, a retrospective explainable record of its actions, the operational boundary it must stay within, and an explicit, enforced expiry of its authority.
Delegated (autonomous) actor
Agarwal's term for what an AI agent now is, as opposed to a passive Q&A chat interface: a first-class entity that acts, chains tool calls, and makes decisions with real-world effect, ideally always 'on behalf of' a human principal.
Acting 'on behalf of' vs. 'impersonating'
The load-bearing distinction of the whole framework: an agent should represent a human's intent and be traceable back to them, but must never assume the human's own identity/credentials to act indistinguishably as that human.
Bounded task grant Delegated Authority Grants (Bounded Task Grants)
The target access primitive: a narrow, time-boxed, task-scoped authorization (bundling delegation + policy + context + time) that replaces a durable API key or long-lived token as 'the next platform perimeter.'
Overprivileged / over-restricted agent
The two failure modes Agarwal frames DPACT as navigating between: an agent with unchecked broad access ('can do anything you ask it to do,' dangerous) versus one so gated by permission requests that it becomes 'worthless.'
Continuous authorization
Re-evaluating an agent's grant at each step against policy, rather than authorizing once at session start — if scope increases or the agent enters a 'dangerous directory,' downgrade or revoke access.

Propositions

explicitAI agents are shifting from passive, low-effect chat interfaces to autonomous 'delegated actors' that take real-world, consequential actions on sensitive data, without identity and authorization frameworks that match that shift.conf: high
explicitcontestedThe core security principle for agentic systems is that an agent should always act 'on behalf of' a human user and must never impersonate that user, because impersonation collapses accountability and enables privilege escalation and policy violations.conf: high
supportsGKE Security Blueprint Joins Growing List of Cloud AI Frameworks · p9 — Both treat dedicated, non-human-shaped agent identity as the fix for impersonation risk; Microsoft's Entra Agent ID (individually scoped, short-lived per-agent credentials) is a concrete implementation of DPACT's Delegation pillar.
contradictsCloudflare WriteGuard Brings Fine-Grained Security Controls for MCP Servers · p4 — DPACT insists an agent must never be identified via a human's own identity-bound credential; WriteGuard deliberately identifies the agent via the human's existing OAuth credential rather than a standalone agent identity, arguing contextual tagging suffices — a live disagreement in the corpus.
explicitThe traditional human-centric identity/access model — hierarchical grants, humans always in the loop, known intent — fundamentally breaks for agents, which act autonomously, chain tool calls, and make decisions without a human validating each step; the old model cannot be applied one-to-one to agents.conf: high
explicitThe DPACT framework — Delegation, Policy, Auditability, Context, Time — specifies the minimum guardrail categories an agentic system needs: on whose behalf it acts, what it can/cannot do, an explainable audit trail, an explicit operational boundary, and an enforced expiry of authority.conf: high
explicitDPACT is explicitly a positional blueprint, not a tool or implementation — it does not prescribe specific tooling or policy engines, only the categories of guardrail a system must have.conf: high
explicitBounded, scoped authority is the correct middle path between an over-privileged agent (dangerous, can do anything asked) and an over-restricted agent (worthless, constantly nagging humans for permission).conf: high
explicitApplying DPACT in product design means setting autonomy tiers by an action's reversibility and blast radius: read-only or proposal actions can run autonomously, but consequential actions (e.g. issuing a refund) must be policy-restricted to 'read and summarize,' scoped to the single case in front of the agent, and escalated to a human rather than pattern-matched across the whole customer base.conf: high
supportsTo Adopt AI at Scale, Employees Need to Trust Agents · p11 — Both independently converge on requiring explicit human confirmation before an agent takes a consequential, hard-to-reverse action.
explicitIn real production incidents (a hiring/interview chatbot, a food-ordering chatbot), end users prompt-injected the agents into writing arbitrary code or content entirely outside their intended task, driving runaway token/agentic costs and forcing feature shutdowns, because the agents had no enforced Context or Policy boundary defining what they could not do.conf: high
explicitAgent governance should be adopted incrementally rather than as a big upfront program: (1) inventory which agents exist, what tools/credentials they use, and what data they access; (2) add visibility (agent ID, task ID, trace ID) and basic audit; (3) separate agent identity from human identity so agents are never handed a human's own token or API key; (4) add human-in-the-loop review for the highest-impact actions; (5) move to continuous authorization that re-evaluates or downgrades scope at each step.conf: high
supportsHow to Manage Privilege Drift in Multi-Agent Systems · p5 — Agarwal's 'continuous authorization' step is the same runtime-enforcement principle Privilege Drift's authors formalize as just-in-time, per-invocation least privilege.
explicitPassing a human's own token or API key directly to an agent is dangerous because the agent can leak that credential, and a leaked human-scoped credential carries far broader blast radius than a properly scoped agent credential would.conf: high
supportsAWS Releases Loom, an Open-Source Reference Platform for Governing AI Agents at Enterprise Scale · p2 — Both treat direct reuse of a human's token/credential as the anti-pattern; Loom's RFC 8693 token-exchange mechanism is a concrete instance of the separation DPACT calls for.
explicitThe single highest-value first maturity milestone in agent governance is not a perfect policy but simply knowing, via inventory, which agents can act and what authority they currently hold.conf: high
explicitIAM vendors should make 'agent on-behalf-of' grants — a short-lived, task-scoped second-layer token derived from (but not reducible to) a human identity, non-reusable and non-attributable back to the user for other purposes — a first-class, out-of-the-box feature, alongside tool providers validating grants and emitting structured audit events.conf: high
explicitThe industry's access-model trajectory should move from 'give the agent a key' (a durable credential) to 'issue the agent a bounded task grant' (delegation + policy + context + time bundled into one scoped, expiring authorization), positioned as the next platform perimeter replacing long-lived API keys.conf: high
extendsAI Model Context Protocol Adds Centralised Auth for Enterprise · p10 — DPACT's Context and Time pillars specify exactly the runtime, per-action controls that MCP's Enterprise-Managed Authorisation explicitly leaves for organizations to build themselves on top of connection-level authorization.
implicitIdentity and authorization gaps, not raw model capability or prompt quality, are already the dominant production failure mode for agentic systems — frontier models (cited: Claude Mythos, 'Fable 5') have shown they can discover and exploit whatever boundary the infrastructure fails to enforce.conf: medium
extendsTo Adopt AI at Scale, Employees Need to Trust Agents · p12 — Agarwal frames the same 'calibrated trust' design goal specifically as an infrastructure/identity failure mode, not primarily a UX or communication failure as the trust-adoption piece emphasizes.
implicitDPACT's five pillars are largely a formalization of familiar human delegation practice (e.g. hiring a babysitter with a fixed time window, a spending cap, and no access to bank accounts or house keys), rather than a genuinely new set of principles invented for machines.conf: medium
implicitThe shift from per-seat software pricing to per-token, 24/7 agent usage is causally linked to the identity problem: because agents run and are billed continuously rather than within a bounded human session, the identity/authorization model must also shift from session-bound human auth to a persistent-but-bounded delegated-authority model.conf: medium

Arguments

Agents must be issued dedicated, bounded, time-limited delegated authority (DPACT-style) rather than durable, human-shaped credentials. strength: high

Explicit premises:

Agents now take real-world, consequential actions on sensitive data without a human validating each step, breaking the hierarchical, human-in-the-loop trust model traditional access control assumed.
Traditional token systems grant broad access for a session's full duration once issued.
A single incident of impersonation or a leaked long-lived credential creates open-ended blast radius and duration of exposure (as in the hiring-bot and food-ordering-bot incidents).

Implicit premises:

Bounded, expiring, task-scoped authority is technically and organizationally feasible to implement now, not merely an aspirational ideal.
The cost of over-restricting agents (permission-nagging, reduced usefulness) is acceptable relative to the cost of under-restricting them.

Inferences:

If bounded task grants become the default access primitive, most current agent architectures — which still pass human tokens or API keys directly to agents — are already operating with unacceptable risk and require re-architecture, not incremental patching.

Organizations should adopt agent governance incrementally (inventory-first), not as a big upfront program. strength: medium