An agent seat is a bounded mandate, not a shared login

Written for the VP of Operations & Supply Chain who is one seat holding everything — and who is, this year, for the first time, seriously considering handing part of the job to an agent, because there is no headcount coming and the work does not care.

The delegation moment is real and it is arriving on ordinary desks: an agent that chases supplier paperwork, answers a retailer's data request, checks whether the 3PL's receiving matches the ASN. The question nobody budgets time for is the one an auditor will eventually ask: when the agent did that, who did your systems say was acting?

The ghost-user problem

The path of least resistance is the one every team takes first: give the agent the credentials of whoever set it up. It works immediately. It is also the quiet destruction of your audit trail, because from that moment every act the agent performs is indistinguishable from an act of the human whose login it borrowed.

Consider what the record holds after a delegated week of supplier follow-ups, run on a shared credential:

Was the 2:41 a.m. query the human or the agent? The record cannot say. Neither can the human, under oath, eleven months later. Every act is warranted by a person who did not perform it and performed by an identity that does not exist. That is not delegation; it is impersonation with extra steps, and the moment anything goes wrong — a wrong disposition, a data request answered with the wrong scope — there is no seam in the record to pull on.

The seat, defined in three sentences

A provisioned agent seat replaces the ghost with three named things.

A mandate ceiling — the outer bound of what the seat may do at all, authored by the human who provisions it. When an ask exceeds the ceiling, the act does not happen; the request lands on the human.

A granted scope — what the seat may read and touch, which is a subset of what its sponsor may read and touch, and which is minimally scoped on read: what is outside it is absent, not greyed out.

A distinct observer identity — every act the agent performs is recorded with the agent as who, the attested observer, and the sponsoring account as capturedBy, the warrantor that stands behind the capture. Those are two different fields answering two different questions — who did it, and who answers for it — and they are never collapsed, because an agent routinely observes under an account it does not own. The vocabulary in full, with three worked receiving events, is who is not capturedBy. The identity grain that makes a person, an agent, and a device all first-class observers is the family's id.org.ai — Agent. Human. Thing.

The same delegated week, run on a seat:

The 2:41 a.m. entry now answers itself. The export the agent could not perform is not a silent failure or a silent grant — it is a recorded escalation waiting for the human whose mandate it exceeded. The first trail is radioactive in a dispute; the second one is evidence.

Why the ceremony matters more for you than for an enterprise

An enterprise brand hands agent provisioning to an identity team. You do not have one. That is precisely why the seat is designed as a ceremony a non-engineer performs: the human authors the mandate in plain terms — what the seat may do, over what scope, up to what ceiling — and provisioning the seat is the integration. There is no IT ticket because there is no IT. The deputization ceremony is the only integration path an organization shaped like yours has, and it is built as one, not adapted into one.

That design has a governance floor underneath it, stated as a rule rather than a hope: absent a pre-registered way to reach its human, every human-gated ask fails closed. The agent that cannot reach you does nothing. A record built on an agent granting itself the benefit of the doubt is not a record anyone should sign their name under — the full argument is in No silent grants.

The question to carry into any vendor conversation

Whatever system your agent will touch — ours or anyone's — the diligence question is one sentence: "When my agent acts, does your record distinguish the observer from the account that warrants it?" If the answer is a shared API key and a user field, you are being sold a ghost. The two-grain answer — attested observer over warrantor account, distinct on every act — is what the seat exists to provide, and it is the shape of every worked example on the seats answer.

Delegation is coming to your desk either way. The only decision you actually control is whether the record of it can defend you.

If you are the seat about to provision the first agent, start the interview — it asks what you would delegate first, and ends with exactly one promise about contact.