Follow the chain that Aditya V Kashyap sets out and the problem stops being abstract: human to enterprise agent to specialist agent to external agent to tool, with the operative question being not who the agent is but on whose authority it acts and how far that authority extends [7]. His illustration is a traveler who lets an assistant spend $2,000 on a trip, and then the awkward follow-ons: can the hotel sub-agent spend the whole amount, can it delegate again, can the airline's agent reuse the credential, can the traveler revoke mid-task, and can each party verify the chain without learning more about the traveler than it needs [8]. Every one of those is a policy someone inside the firm has to write down before the transaction, not reconstruct after it.
The pieces to write it with already exist. Enterprises have run machine identity for decades on PKI, service accounts and policy engines, and OAuth 2.0 has handled delegated access since 2012 [5], roughly fourteen years before this argument was published [1]. RFC 8693 defines token exchange with delegation semantics, including a nestable claim that records who acts for whom [9]; RFC 9396 replaces flat scopes with structured authorization details [10]; RFC 9700 favors sender-constrained tokens, which blunt the value of a stolen token to an attacker without the matching key material [11]. From those you can express something as specific as "Agent B may invoke Tool C for Company A on this task, for 15 minutes, below $10,000, and may not delegate further" [12]. The shortfall lies in agreement on what those words mean once the mandate leaves your domain, a gap Kashyap treats as an open implementation problem rather than a cryptographic one, with the missing portable artifact standing as a proposal rather than a standard [12][13].
Scopes, expiry and revocation have existed for years, which might suggest this is a solved problem in new clothes. What sets agents apart, per the source, is the combination: autonomy, delegation, dynamic tool use, persistent state and interaction with other autonomous actors, which together give an agent substantially more runtime discretion over which tools to call, whom to contact, what to disclose and what to delegate than a conventional service moving through a predetermined workflow [6].
Zero trust gets the posture right without supplying the artifact. NIST SP 800-207 rejects network location as a basis for trust and makes access a dynamic, per-session, per-resource decision [17], and Kashyap extends that to agents: do not trust one because it sits inside the enterprise, was spawned by a trusted application or holds a valid credential, but verify the authority for this action and expect it to be task-specific, time-bounded, observable and revocable [18].
How big the gap actually is remains outside the record. This is one practitioner's argument, and it contains no measurement of how many enterprises running agents have built delegation limits, provenance or revocation [2]. So the honest statement is that the shape of what's missing is visible, while the actual distribution stays unknown. The decision in front of an operator this quarter is the scope of autonomous spend inside a boundary the firm controls. The consequence next quarter is whether the logs can answer, on demand, whose authority a purchase was made under.
