In an identity context, an AI agent is a piece of software, often built on a large language model, that can take actions on behalf of a person or organization, such as booking a service, checking an account balance, or executing a transaction, typically without a human directly operating each step. For authorization purposes, an AI agent is commonly modeled as its own OAuth 2.0 client with its own credentials, distinct from the human customer it acts for.
Frequently asked questions
What's the difference between an AI agent and a bot, for identity purposes?
A bot is unauthorized automated traffic a system tries to block; an AI agent is authorized automated software acting with a customer's explicit consent and a scoped set of permissions. Behaviorally they can look similar, which is why identity-based authorization, not just bot detection, is needed to tell them apart.
How does an AI agent get authorized to access a customer's account?
It registers as its own OAuth 2.0 client, the customer authenticates and sees a consent screen naming the agent and its requested scopes, and if approved, the agent receives a token limited to those scopes and that resource.
Is an AI agent the same as machine-to-machine (M2M) authentication?
Related but not identical; M2M typically involves a service acting under its own standing authority with no specific end user behind the request, while an AI agent acts under authority delegated by a specific customer. See delegated authorization.
.avif)