Research into two-party agentic delivery
Distinct machine identities, credential ownership, delegated permissions, and access lifecycle.
AAO-014 / Data, Technology, and Security
Infrastructure managers should authorize provider agents through task-specific identities and tested revocation. Initial use should remain limited to approved low-risk support, with operational engineering defining how access can be withdrawn safely.
AAO-006 / Governance and Accountability
The buyer should approve a bounded grant of business authority for every outsourced agent. That grant must survive tool use, further delegation, configuration change, and revocation across both organizations.
AAO-004 / Governance and Accountability
Bank payment and vendor-access managers should preserve independently enforced preparation, approval, and execution when provider agents act. Different agent names do not establish separation if one credential or administrator can control the entire transaction.