Agent Identity Is Not Enough. The Industry Needs Professional Mandates.

AI identity is becoming an urgent operational concern. Organisations need to know whether an action came from a person, an AI agent, a delegated agent or an unauthorised process. They need to limit scope, revoke access and preserve accountability when automated systems act across enterprise boundaries.

Those are necessary controls. But identity alone cannot answer the professional question: on what basis was this particular action justified?

An emerging Internet Draft, the Agent Identity, Trust and Lifecycle Protocol, explores identity, scoped mandates, lifecycle management, revocation and trust verification for agents. It is expired and is not an IETF standard or formal endorsement. Its importance is directional. The ecosystem is beginning to recognise that agentic systems require identity, bounded mandates and lifecycle control.

The industry pain: technical access is being mistaken for professional legitimacy

Consider three common situations. A finance agent can access accounts payable but has no authority to approve an exception above a defined threshold. A legal agent can retrieve a contract but cannot decide that a commercial compromise is acceptable without the required instruction and risk authority. A security agent can triage an alert but cannot shut down a business critical service unless the impact, condition and escalation requirements are established.

In each situation, the agent may be authenticated, technically permitted and correctly identified. The action is still illegitimate if it exceeds mandate, lacks necessary evidence or bypasses an independence requirement.

The gap between access control and professional legitimacy is where organisations will face avoidable risk, dispute and distrust.

The Professional Anunnaki Twin is a mandate, not merely an identity

Anunnaki.Live extends identity into professional computation. A Professional Anunnaki Twin has an identity, but it also has a profession projection, professional DNA, Role Constitution, authority envelope, present coordinates and Necessary Work. Together these define the conditions under which a request may progress to an outcome.

Emerging agent control concept	Anunnaki.Live capability
Agent identity	Professional identity
Scoped mandate	Role Constitution and authority envelope
Lifecycle and revocation	God Code horizons, expiry and withdrawal of authority
Trust verification	Evidence admission and confidence constraints
Auditable activity	Receipt ledger and Replay

The distinction is important. A scoped technical permission can say that an agent may call a service. A professional mandate must also establish why the action is in scope, which evidence supports it, which limits apply, what must remain with a human professional and when that permission expires.

Replay is the test of the mandate

When an outcome is questioned, a relying party should not have to accept that an agent was verified. They should be able to inspect the request, represented professional identity, authority in force, evidence admitted, conditions satisfied, action performed, outcome produced and matters left unresolved.

Replay makes this possible. It turns a general assurance statement into an inspectable professional record. It also preserves time. Revocation should stop new work, but it should not rewrite the history of work performed under a then valid mandate.

What boards and professional bodies should require

• Can the organisation distinguish a verified agent from a professionally authorised actor?
• Is the scope of delegation specific to the role, matter, jurisdiction and enterprise boundary?
• Are expiry, withdrawal and independence conditions actively enforced?
• Can the system refuse work when the evidence or authority is insufficient?
• Can a permitted third party replay a material outcome without relying on a reconstruction from memory?

These are not theoretical questions. They decide whether a future professional workflow can be relied upon by a client, an employer, a regulator or another professional.

The Anunnaki.Live position

The future of AI governance will not be secured by identity alone. It will require identity combined with mandate, evidence, limits, expiry, human reserved judgment and replayable accountability.

A Professional Anunnaki Twin is therefore not simply known by the system. It is constituted inside a bounded professional universe. It cannot invent authority, capability or action outside its boundary, and its material work is designed to remain explainable and replayable.

Source and status

This article considers the Agent Identity, Trust and Lifecycle Protocol Internet Draft. The draft is expired and has no formal IETF standing. It is an interoperability watch item, not a protocol with which Anunnaki.Live claims compliance.