Diary / field note
Estonia is giving AI agents the missing piece: accountable identity
AI agents will not be trusted at scale until they can prove who they act for, what they are allowed to do, and who is accountable.
Estonia is moving toward official digital identities for AI agents.
That sounds niche.
It is not.
It is one of the missing pieces in the agent economy.
The Estonian government says AI agents should be able to act on behalf of a person or company with limited and controllable powers. For example: view data, prepare a document, draft a payment or operate only within a specific financial limit.
That is the right problem.
Most current agent workflows are a mess of borrowed authority.
Give the tool your login. Give it access to your inbox. Give it your card. Hope it behaves. Hope the other systems understand what it is allowed to do. Hope somebody can reconstruct what happened if it breaks.
That does not scale.
For agents to do useful work in the real world, they need identity and delegation:
- who is this agent
- who does it represent
- what can it access
- what can it change
- what financial limits apply
- what gets logged
- who is responsible when something goes wrong
Estonia understands this because its digital state was built around identity, signatures, X-Road and traceable digital footprints. It is not treating agents as magic helpers. It is treating them as actors inside a permission system.
That is the serious version of the AI agent story.
Not “my assistant can book a holiday”.
“My delegated software can act within defined rights, and every system it touches can verify the authority behind the action.”
That is when agents become infrastructure rather than toys.
The companies building agent systems should pay attention.
The winners will not just have better models. They will have better permissions, audit trails, escalation rules and accountability.
Sources: Estonian Government, Computerworld, The Register