Hold AI agents to the same checks as the customer they act for

How to do it

Customers now send assistants to cancel plans, ask for refunds or chase orders, by email, chat and phone. A message that says "I am the assistant of Kim" proves nothing. Accept it from the verified contact on file. Also accept it with a token the customer granted to that agent, as Name each party in its own token claim describes. Tag such tickets "agent", so you can measure them and see abuse. Answer in plain text with stable field names, since a program reads the reply. Set a policy per agent operator as Set a policy for each agent operator says.

Examples

JavaScript example

export function mayRevealAccount(ticket, account) {
  if (ticket.fromVerifiedContact) return true
  return ticket.delegatedGrant?.accountId === account.id && ticket.delegatedGrant.scopes.includes('support:read')
}

Python example

def may_reveal_account(ticket, account) -> bool:
    if ticket.from_verified_contact:
        return True
    grant = ticket.delegated_grant
    return bool(grant and grant.account_id == account.id and "support:read" in grant.scopes)

How to check

A test email from an unknown address that claims to be a customer's assistant asks for the order history. The reply reveals nothing and explains how the customer can grant access. The same request with a valid delegated grant gets the history, and the ticket is tagged "agent".

Related rules

• AGT-6 Name each party in its own token claim in Agents as users
• AGT-3 Set a policy for each agent operator in Agents as users