Answers · agent trust
How do I make a named human the accountable owner of an AI agent on the record (who owns it, who approved each action, which permission applied)?
Last updated
TL;DR: Register the agent before it acts, and make the registration name one accountable human owner: a person (not a team alias or a service account) with a verified identity, recorded alongside the agent's key and its exact configuration (model, system-prompt hash, tool list, code version). Then link every action back to that record with three pointers: the agent credential or key that acted, the permission or grant that allowed the action (scope, limits, policy version), and, for anything that needed a person, the approval id of the human who said yes. With those links an auditor can walk from any action to who owns the agent, who approved that action and which permission applied, without trusting the agent's own account of itself. Ownership changes (handover, leaver, reorg) are new entries, never edits, so the owner at the time of each action stays answerable. issue_agent_credential binds an agent's key to its exact configuration and to your account's verified owner tier; request_human_approval accepts that credential_id so each approval names the agent it covers.
What should I check, step by step?
1. Keep an agent registry: agent id, public key, accountable owner (a named person with a stable IdP subject id), a backup owner, purpose, and the environments it may touch. No owner, no credentials.
- Verify the owner once at a tier that fits the risk (verified work email, verified domain, verified business, government ID) and record the tier, not just a typed name.
- Bind the owner to the agent's exact configuration: model id, system-prompt hash, tools or tools hash, code version. A changed configuration is a new credential, so the owner signs off on what actually runs.
- Issue short-lived, scoped credentials to the agent instead of sharing the owner's own login or API key. Each action then carries a credential id that resolves to the owner.
- Record the permission that applied to every action: grant or policy id, policy version, scope and limits. Keep it with the action record, not in the prompt.
- For actions that need a person, record the approver separately from the owner. The owner answers for the agent; the approver answers for that action. They can be the same person, but the record should say so.
- Make ownership transfers explicit: a signed handover entry with old owner, new owner, effective time and reason. Revoke or reissue credentials when an owner leaves.
- Review the registry on a schedule: agents with a departed owner, expired verification or no activity get suspended or revoked (revoke_agent is the kill switch).
Why does an AI agent need a named human owner?
An agent is a model, a prompt, a tool list and code, and any of those can change in minutes. The stable thing to hold accountable is the person who deployed it and keeps it running, the same way a vehicle registration names a keeper rather than describing the car's behaviour.
- Team aliases and shared service accounts dissolve accountability: when something goes wrong, nobody on the alias owned the decision. Name a person and a backup.
- Governance frameworks point the same way. The NIST AI RMF's GOVERN function asks organisations to document roles and responsibilities for AI systems, and the EU AI Act (Article 26) expects deployers of high-risk systems to assign human oversight to named natural persons with the competence and authority to do it.
How do I link every agent action to its owner, approver and permission?
Each action record should carry credential_id (which resolves to the owner), grant or policy id plus version (the permission that applied) and, where required, approval_id (the human who approved). Three ids, three answers.
- request_human_approval takes an optional credential_id, so the approval request and the signed decision receipt name the agent credential they cover. verify_agent_credential checks a credential's signature, expiry, revocation, configuration hash and scope for free.
- report_agent_evidence can attach signed action logs (send payload_sha256 of the log you keep, not the log itself) to the credential, so the owner's record grows with what the agent actually did.
- How to record a named approver and policy version in a tamper-evident entry for every agent approval covers the per-approval entry; this page covers the ownership record those entries point back to.
Can an agent's owner be on the record without being public?
On the record does not have to mean public. Rightshold certifies the owner's verification tier and never shows the identity publicly by default; per connection the owner chooses anonymous, tier only, organisation or full identity, with both sides consenting.
- Inside your own organisation the registry can show the full name; to an outside site or counterparty the credential can prove a verified owner of a given tier stands behind the agent without naming them.
- How can an AI agent prove a verified human is behind it covers the selective-disclosure side in more depth.
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Issue a short-lived credential for my support agent that binds its key to its exact configuration and my verified owner record, scoped to refunds under $100, so every action and approval can be traced back to me.”
{
"tool": "issue_agent_credential",
"arguments": {
"agent": "support-refunds-bot",
"public_key_pem": "-----BEGIN PUBLIC KEY-----…",
"config": {
"model_id": "provider/model-2026-10",
"system_prompt_sha256": "sha256:7d20…",
"tools_sha256": "sha256:c4f8…",
"code_version": "git:3e1a9b0"
},
"scope": [
"refund:under_100"
],
"ttl_hours": 24,
"disclosure": "tier_only",
"signature": "<CredentialRequest signature, see /agent-credentials>"
}
}- Needs your API key. verify_agent_credential is free and keyless and returns the owner tier, never the identity unless you chose to disclose it.
- Pass the credential_id to request_human_approval so each approval names the agent it covers; decide_human_approval (owner account key) signs the decision onto the ledger, and verify_human_approval is free.
- record_ai_run seals what the agent's model produced for an action; report_agent_evidence attaches signed action logs to the credential.
- revoke_agent revokes the credential or key immediately when the owner leaves or the agent misbehaves; check_revocation is free.
Rightshold certifies an account's verified owner tier and an agent's exact configuration for a limited time and scope, and records approvals and evidence linked to that credential. It does not run your HR or identity systems, decide who should own an agent, or guarantee how the agent behaves. A credential describes an accountable owner and configuration at a point in time. Not legal advice.
What are the sources?
- NIST AI Risk Management Framework (AI RMF 1.0): GOVERN function, roles and responsibilities
- EU AI Act, Regulation (EU) 2024/1689: Article 14 (human oversight) and Article 26 (deployer obligations)
- RFC 8693: OAuth 2.0 Token Exchange (subject and actor)
- Agent credentials on Rightshold
- Human approvals on Rightshold
Related
- How can an AI agent prove a verified human is behind it?
- How to audit which human authorized an AI agent action
- How to record a named approver and policy version in a tamper-evident entry for every agent approval
- How to inventory MCP servers with scope, owner, and revocation
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'