When an AI agent asks for your data: delegation with limits
An AI agent acting for a person should hold a narrow, expiring, countable slice of their consent, never their credentials. Delegated capabilities on Essence are built that way.
A person asks an AI assistant to prove to a letting agent that they are over 18. The easy design hands the assistant the person's identity document and lets it pass on whatever seems needed. The letting agent then sees a full date of birth, and perhaps an address and a document number, when it needed one fact. The assistant now holds a copy of all of it.
As agents start acting for people, the question for any organisation handling personal data is what authority those agents hold, for how long, and what they get to see. Our answer on the Essence platform, added in our September release, is the delegated capability: a narrow, expiring, countable slice of a consent the person has already given.
What a capability names
A capability is issued under an existing consent between the person and an organisation, here the letting agent. It names:
- the one agent that may use it;
- the operations it may perform and the fields it may involve;
- the purpose and the recipient;
- an expiry, after which it is refused;
- a maximum number of uses, counted on our server;
- a disclosure ceiling, the most any presentation under it may reveal. The default is selective disclosure, the person can lower it, and full disclosure is never the default.
A capability can only narrow the consent beneath it. It cannot add a field, a recipient, a purpose or a longer window, and it cannot be issued under a consent that has lapsed or been withdrawn. It carries field names and references, never values.
The least that answers the question
When the assistant asks, the platform plans the least disclosure that answers the request. For an age requirement, its rules prefer an over-18 claim derived by the issuer to the date of birth itself, and refuse rather than go above the ceiling. The person sees the planned level before deciding, and again in their history afterwards. Where the issuer provides that claim, the letting agent learns that the person is over 18, and not when they were born.
What the agent never holds
Agents reach credentials only through a gateway that offers five operations, each stating an intent. The rest of the platform refuses an agent's token unless it has been explicitly marked to accept one. Nothing the gateway returns can carry a credential body, a presentation, key material or raw bytes.
The presentation itself travels from the person's own enrolled device, which signs it, to the verifier. It never passes through the agent. If the agent were compromised, none of the person's credentials would be in it to take.
Stopping an agent
Withdrawing the consent withdraws every capability issued under it, and a single capability can be withdrawn on its own without touching the consent. Each use is recorded, one record per use, and a capability that has reached its limit is refused, so a limit of one is a true single use. A capability presented by the wrong agent, an expired one, or none at all is refused, and nothing is submitted. If an agent is suspended for overreaching, its capabilities are withdrawn and its unfinished operations are cancelled.
Every agent presentation appears in the person's disclosure history, attributed to the agent and to the capability it used. Where an organisation lets an agent work on its members' data, any one person can stop the agent for themselves without stopping it for anyone else.
Because a capability is part of a consent rather than a separate permission system, withdrawal and the disclosure record cover what the agent does in the same way they cover the consent. The design draws on IETF work on agent delegation, and the format of a capability is left open so it can follow that work as a standard settles.
For an organisation weighing AI agents against its data protection duties, this means an agent can act for a person without holding more than the person agreed to, and without holding their credentials at all. If that question is on your table, we would be glad to walk you through it.
Published 13 October 2026