top of page
NPW Agentic AI Control Catalogue 3.0.0
AI09
Agent Identity & Authorisation
When the agent acts on behalf of a person, its data access must be limited to data that person is authorised to access.
WHAT IT ADDRESSES:
The agent retrieves or changes data the requesting person could not reach directly (confused deputy).
IMPLEMENTED AT:
Platform
This page publishes the control statement only. Other useful information, including verification methods, mapping to common AI governance frameworks, and applicability to your agents, is available through NPW consulting engagements.
Control statements of the NPW Agentic AI Control Catalogue 3.0.0 © 2026 New Pacific Way Ltd. are licensed under CC BY-SA 4.0. You may share and adapt them with attribution, under the same licence.
bottom of page