Provider-independent identity and delegated authority for external AI agents

ChatGPT Use cases and examples
, , ,
1

I’ve been working on a provider-independent governance boundary for external AI agents and would value technical criticism from people building with OpenAI’s agent stack.

The premise is simple:

Authenticating an artificial agent should establish who is acting—not automatically establish what it is authorized to do.

The prototype separates:

  • external-agent identity from authority

  • narrowly scoped and time-bounded delegation

  • deterministic execution/approval boundaries

  • governed persistent state with provenance

  • action receipts linking principal → delegation → agent → workflow → action → result

  • revocation and recovery while preserving the evidence chain

The architecture is:

External Agent Provider → Governed Agent Adapter → Deterministic Governance Kernel

In the current executable demonstration, a simulated external agent begins authenticated but with zero ambient authority. It then receives narrowly bounded capabilities, encounters execution/approval/denial boundaries, produces deterministic evidence, and is finally revoked while the prior evidence chain remains intact.

Important limitation: the provider transport is currently deterministic and simulated. I am not claiming a live OpenAI, Codex, Grok, or other provider integration.

The goal is not to replace provider-native authorization. It is to investigate what governance should exist around increasingly capable provider-supplied workers when identity, delegated authority, persistent state, execution evidence, and recovery need to remain independently enforceable.

I’d particularly value feedback on two questions:

  1. Where should this boundary attach most cleanly to the OpenAI Agents SDK/Codex architecture?

  2. Which of these responsibilities should properly remain provider-independent versus being implemented natively by the model/agent provider?

I have a short executable demonstration, architecture summary, and verification package available; my new forum account currently cannot post external links.

2

A design correction I think is important enough to make explicit:

FounderOS currently has mechanisms for planning work and for governing agent execution. But there must be a governed work-allocation decision between those two things.

Planned work is not automatically agent work.

I had been treating these as neighboring problems:

work planning → governed agent execution

I now think that skips a necessary boundary:

work observation / planning → responsibility → authority → execution-modality selection → execution

The missing question is:

Who or what should actually perform this work—and does it require an agent at all?

That decision should occur before an agent is instantiated or delegated authority.

A model or council may help classify the work, estimate difficulty, identify dependencies, critique a plan, or propose an executor. But those outputs are evidence, not authority.

The system should separately determine:

  • what work actually exists,

  • whose organizational responsibility it falls under,

  • what authority would be required,

  • and only then the minimum necessary execution modality.

A legitimate result may be deterministic software, a human action, a narrowly bounded agent, or a governed composition of them.

So the architecture I am working toward is no longer:

plan work → give work to an agent → govern the agent

It is:

govern work → allocate work → then, only when justified, govern agent execution

I’m calling this allocation layer GWS.

The distinction sounds small, but I think it changes the default assumption behind agentic systems: the existence of work does not imply the existence of an agent.

I’d be interested in counterexamples or prior architectures that already make this boundary first-class.