A Valid Credential Can Still Identify the Wrong Agent
TL;DR for operators An AI agent can authenticate successfully while its credential, software client, or external identity record is associated with the wrong persistent actor. This becomes consequential when agents operate across deployments, rotate credentials, and accumulate audit histories. SoulAuth proposes a stable ActorIdentity for each independently identifiable Human or long-lived AI actor. Credentials, clients, sessions, and cross-domain identity relationships remain separate objects with their own lifecycles. Authentication proves an identity under specified conditions; it does not automatically establish permission to act. ...