Identity Management

TL;DR for operators An AI agent can authenticate successfully while its credential, software client, or external identity record is associated with the wrong persistent actor. This becomes consequential when agents operate across deployments, rotate credentials, and accumulate audit histories. SoulAuth proposes a stable ActorIdentity for each independently identifiable Human or long-lived AI actor. Credentials, clients, sessions, and cross-domain identity relationships remain separate objects with their own lifecycles. Authentication proves an identity under specified conditions; it does not automatically establish permission to act. ...

Access tokens are convenient little monsters. Hand one to an application and, for a while, the receiving API behaves as if the bearer of that token is a faithful representative of the user. In normal software, that assumption is often good enough. The app has deterministic code. The button does what the button was built to do. The workflow may be dull, but dullness is a security feature. ...