Power of Attorney for AI Agents: What 'Fullmakt' Teaches About Delegated Authority
6 min read Fullmakt Team
- governance
- authentication
- credentials
- traceability
- agents
- mcp
- a2a
- business-case
Short answer: an AI agent acting on your behalf is a delegate, and delegation has been solved on paper for centuries. A power of attorney (in Scandinavian languages, a fullmakt) works because it states four things: who may act, what they may do, for how long, and how it is revoked. Most agent deployments today record none of the four. They hand the agent a long-lived API key and hope. This post maps the four properties onto MCP, A2A and the login handshake, and shows what a credential broker adds.
What is a power of attorney, and why does it matter for AI?
A power of attorney is a written grant of authority. A bank will not release funds because someone says “I act for the account holder”. It asks for the document, checks that the action falls inside its scope, checks that it has not expired or been withdrawn, and keeps a copy. The document is what lets a third party trust a delegate without trusting the delegate’s character.
An AI agent calling a payment API, a CRM or a code host is in the bank’s position reversed: the agent holds a credential, and the service has no way to ask whether this particular call is inside what the human intended. The credential says “the bearer may do things”, not “the bearer may do these things, today, for this task”.
The four properties, mapped to agent systems
1. Who: named, individual identity
A power of attorney names a person. A shared service-account key names nobody. When three agents share one key, the audit log cannot say which of them deleted the record, and revoking the key stops all three. This is the root of most agentic AI gone wrong incidents: authority was granted to “the system”, so responsibility belonged to no one. Each agent needs its own identity, and each action needs to carry the human or workload it acts for. See non-human identity governance for AI agents and the A2A delegation chain.
2. What: a bounded scope
A power of attorney for selling a flat does not authorise emptying a savings account.
Agent equivalents are scoped tokens, per-tool policy and response filtering. OAuth
scopes are coarse (read:invoices), but the risk sits in the arguments: which
invoice, which recipient, what amount. That is why policy has to be evaluated
per call, not once at connection time, a point we made about
MCP tool poisoning and the
MCP rug pull.
3. For how long: expiry and freshness
Authority that never expires is not delegation, it is abdication. The MCP and A2A login handshakes issue a token once and the token then outlives the task, the conversation and sometimes the employee who approved it. Short-lived, task-bound credentials fix this. Our comparison of login handshake procedures for AI agents and the post on refresh tokens cover the trade-offs.
4. How it ends: revocation that works the same day
The test of a power of attorney is what happens when the principal changes their mind. For agents, the equivalent is a kill switch, offboarding that actually removes access, and a leaked key that can be rotated in minutes rather than hunted for across repositories. See the kill switch and circuit breaker, agent offboarding and rotating a leaked agent key.
The fifth property law adds: a record
Notaries and registries exist because delegated authority is only useful if it can be proven later. For agents that means traceability, not just observability. Observability tells you the system was busy. Traceability tells you that this call was made by this agent, under this grant, approved by this person, and returned this result. Without it a dispute with a customer, an auditor or a regulator turns into reconstruction. See observability vs traceability and audit trail forensics.
Why the handshake alone does not give you this
OAuth in MCP and the agent card in A2A answer “may this client connect?”. They are the equivalent of showing ID at the bank door. They do not check the power of attorney against each transaction. A broker or gateway sitting between agent and service is where scope, expiry, approval and record are enforced per call.
| Property | Typical shared API key | Broker-mediated delegation |
|---|---|---|
| Who | One key, many agents | One identity per agent and client |
| What | Whatever the key can do | Policy evaluated on each call |
| How long | Until someone remembers | Short-lived, task-scoped credentials |
| Revocation | Rotate and redeploy everywhere | Revoke at the broker |
| Record | Service-side logs, if any | Chained audit of request, decision and result |
Where Fullmakt fits
Fullmakt is built around this model, and the name is the point. Agents never hold the long-lived secret. They request an action, Fullmakt evaluates the collection’s policy, asks a human for approval when policy says so, dispenses a scoped credential only for the approved call, and writes an audit record either way. It works with MCP clients and A2A agents, so the delegation story is the same whether an agent is called from Claude, ChatGPT or another agent.
The business case is concrete:
- Sell to enterprises faster. Buyers now ask who the agent is, what it can reach and how actions are traced. See the enterprise security questionnaire for AI agents.
- Shrink incident cost. Revoking one agent at the broker beats rotating a key across every system that copied it.
- Keep data ownership clear. Responses are filtered before they return to the agent, so delegated access does not become delegated copying. See agent data egress.
- Meet governance frameworks. Scoped grants and traceable records map to SOC 2 and ISO 42001 and the EU AI Act evidence requests.
FAQ
What is a power of attorney for an AI agent?
It is a design pattern, not a legal document: a named agent identity, a bounded scope of permitted actions, a limited lifetime and a revocation path, with every use recorded. It gives services and auditors the same assurance a legal power of attorney gives a bank.
Is an OAuth token enough?
A token proves a grant happened. It does not enforce what each call does, expire with the task, or record who approved it. You need policy and audit around the token.
Does this apply to both MCP and A2A?
Yes. MCP delegates a tool call from a client to a server; A2A delegates a task from one agent to another. Both need identity, scope, expiry, revocation and a record.
What does Fullmakt mean?
Fullmakt is the Scandinavian word for power of attorney: authority granted by one party to another to act on their behalf, within stated limits.
See how Fullmakt brokers credentials for AI agents or browse the Fullmakt blog.