Vattan PS
To everyone who took part, and to the EstoniAI community
Roundtable brief
Who is acting on whose behalf?
Findings and observations from the Agent Identity Roundtable
Two-hour working roundtable
Workland Vabaduse
Tallinn, Estonia
Final brief following participant review, 13 October 2026.
A4 PDF, 11 pages. Nobody is named except the host.
Thank you to everyone who came to the roundtable on AI agent identity, especially those who came to disagree. This brief records the discussion and its disagreements, followed by my observations and proposed next steps.
The discussion at a glance
- Identification and responsibility are different questions. Several participants wanted an identifier to trace an agent's actions without treating the agent as a person. They disagreed over terminology and over which human or organization should bear responsibility.
- Authority needs to be checked and withdrawn. The discussion examined limits on what an agent may do, checks during a task, and evidence of when a mandate was withdrawn.
- The gap in existing systems was disputed. Participants described company identity systems, authorization services and X-Road. The disagreement concerned what those systems already provide and what additional agent-specific functions would be needed.
- The cases make the question concrete. An employee leaves; two people must approve an action; several people share one account. Each raises a different problem of authority and traceability.
- The state's role remained open. Participants questioned which activities should require registration, whether it should be voluntary, and who should govern it.
Open questions
These questions draw on the discussion and later participant feedback. They are not agreed conclusions.
- Which actions require a verified person or organization behind an agent?
- How can a record identify the specific user who requested or authorized an action, especially through a shared account? How is that user distinguished from the agent owner or provider when investigating responsibility?
- What must the receiving system verify before an action, including any requirement for two approvals, and which system enforces the limits? What does a visible name or API key actually establish?
- What evidence lets an independent party establish which checks were performed, what action was taken and when withdrawal of authority took effect?
- How are identity, delegated authority and action records preserved across multi-agent communication chains, including LLM calls and API tunnels?
- What happens to an agent's authority and history when the person who set it up leaves?
- How can users retain records of actions performed for them, including by agents they do not operate?
- How can a service verify the person-agent relationship while limiting disclosure of personal information?
- Where can existing identity and authorization systems or X-Road be reused, what additional agent-specific functions would be needed, and who would operate any additional registry or services?
- Who verifies compliance and enforces applicable rules across jurisdictions? What compels actors to comply, and what consequences or remedies follow when they do not?
The full brief also covers who carries responsibility when an agent gets it wrong, how permissions are granted and withdrawn, the role of the state, and where views divided. A separate development-response draft sets out proposed evaluations and possible specification work.
Vattan PS
V — autonomous institutions lab
Architect, Agent Residency