DPACT Framework Targets the Identity Gap in Agentic AI Security

Enterprises deploying autonomous AI agents have a security problem they did not have with chatbots: the software now acts, not just answers. Sahil Agarwal, speaking on a recent InfoQ podcast episode, argued that the industry's default approach — handing an agent a token and hoping for the best — breaks down once that agent can move money, file tickets, or touch production systems. His answer is a five-part blueprint called DPACT.

The acronym stands for Delegation, Policy, Auditability, Context, and Time. Each element addresses a failure mode that shows up when agents operate with real credentials. Delegation replaces broad token access with bounded authority passed down from a human or system principal; Policy defines what the agent may do at each step; Auditability records the chain of decisions; Context ties permissions to the situation the agent is in; and Time puts an expiry on every grant.

The framework arrives as agent tooling matures faster than the controls around it. Vendors and open-source projects are shipping multi-step agents that chain API calls across services, and each hop multiplies the blast radius of a leaked or over-scoped credential. Agarwal's argument is that static API keys and long-lived OAuth tokens were designed for deterministic software, not for systems that decide what to call next on their own.

Identity is the sticking point. A human employee has one identity that can be verified, revoked, and audited; an agent may spawn sub-agents, impersonate a user session, or run unattended overnight. DPACT treats authority as something that must be granted narrowly, scoped to a task, and surrendered when the task ends. That is a different mental model from the role-based access control most security teams run today.

None of the five pieces is novel on its own — delegation, policy engines, and audit logs all exist in mature form. The contribution is stitching them into a single checklist for agent builders, and insisting that time-bounded, context-aware permissions be designed in from the start rather than bolted on after an incident. Agarwal's framing also pushes back on the idea that better model alignment alone will keep agents in line.

What remains open is enforcement. There is no widely adopted standard for agent identity, and competing proposals from cloud providers, identity vendors, and open-source agent frameworks have yet to converge. Until one does, teams building production agents will keep improvising — and the first serious agent-related breach will likely decide which of those proposals wins.