The internet is increasingly becoming a web of authenticated actors. People sign in, organisations issue credentials, wallets sign transactions, and now AI agents are beginning to act on behalf of individuals, companies, governments, and communities. Across almost every domain, we have invested enormous effort into answering a deceptively simple question: who are you?
The results are impressive. Digital identity systems can verify credentials across borders. Cryptographic systems can establish control over assets and accounts. Organisations can issue permissions, delegate access, and record decisions at a scale unimaginable only a generation ago. As these systems mature, attention is naturally shifting towards a second question: are you authorised to do this?
This question sits at the centre of many contemporary discussions about AI. As agents become more capable, concerns around delegation, accountability, consent, oversight, and revocation become increasingly important. We want to know who granted authority, where its limits lie, how it may be withdrawn, and who bears responsibility when something goes wrong.
Yet the more I explore these questions, the more I find myself drawn towards a deeper one. A question that legal systems, institutions, communities, and governance structures have been asking for centuries, often before any discussion of authority begins.
By what standing does this actor participate at all?
It is an unusual question because modern digital systems rarely ask it. Identity systems assume a participant already exists. Governance systems assume a participant already belongs. Permissions systems assume a participant is already present within the field of action. The question of standing tends to disappear into the background.
Law, however, has never had that luxury.
Courts routinely ask whether a party has standing before they can even be heard. Companies differentiate between shareholders, directors, officers, employees, and agents – not because the distinctions are administratively convenient, but because they determine whose voice carries weight in which decisions, and who bears responsibility when things go wrong. Indigenous legal traditions often ground participation in relationships, obligations, kinship, stewardship, and collective recognition rather than possession of credentials or documents alone. Across all of these traditions, identity alone tells us remarkably little. Knowing who someone is does not explain why they are present within a particular process, whose interests they represent, or why their actions should carry weight.
Standing is rarely a matter of identity alone.
It emerges through relationships, roles, obligations, recognition, and the cultural grounds upon which a participant appears within a particular context. Sometimes those grounds are formally conferred through institutions and instruments. Sometimes they are constituted through community recognition, stewardship, kinship, or ongoing practice. In every case, standing must ultimately be capable of being articulated. A system cannot meaningfully evaluate participation if the basis of participation remains invisible.
The distinction between identity and standing may seem subtle. But consider what it means for a system that acts.
An AI agent may possess valid credentials, satisfy every permission check, and execute every instruction exactly as designed. It may appear entirely compliant from a technical perspective. And yet something remains unresolved – something that a court, a counterparty, or an institution would need to know before treating its actions as binding. Is it acting as an adviser, an executor, a delegate, a representative, a trustee-like steward, or something else entirely? Whose interests is it carrying? What gives others reason to recognise that role? And critically – does the authority under which it is acting still hold, or has it been superseded, exceeded, or revoked without the system knowing?
These are not edge cases. They are the ordinary conditions of institutional life. When they go unasked, the gap doesn't disappear – it accumulates silently, in actions taken under authority that was never properly established, in reliance placed on roles that were never properly recognised.
This is a question of participation, recognition, legitimacy, and responsibility, not merely a technical problem. The same question that legal traditions have been working out for centuries, now arriving at the threshold of systems that have no shared vocabulary for answering them.
Perhaps this is why so many debates around AI governance feel incomplete. Discussions about safety, alignment, and constitutional principles often focus on behaviour: what should a system do? Equally important is the question of position: from where does this system act? On whose behalf? Within what relationship? Recognised by whom? These questions are not reducible to credentials or permissions. They concern the structure of participation itself – and they need to be answered before questions of authority can be meaningfully posed, let alone evaluated.
I do not think we yet possess a shared vocabulary for these issues. The language of identity is too narrow. The language of authority often arrives too late. Between the two sits a rich terrain that legal traditions, commercial systems, communities, and governance structures have been navigating for generations.
As AI agents become increasingly woven into economic, civic, and institutional life, that terrain will become harder to ignore. Building it into digital infrastructure is not a refinement of what we have. It is a different kind of work – closer to the work that established the conditions for legal personhood, commercial agency, and institutional accountability than to the work that built authentication systems and permission frameworks.
The internet spent thirty years building infrastructure for identity. The next chapter may require infrastructure for participation itself: a way of expressing why an actor is present, whose interests they carry, what responsibilities attach to them, and under what conditions others may rely upon their actions.
Before a system can determine whether an action is authorised, it may first need to understand why the actor has standing to act at all.
Standing is not a substitute for identity or authority. It is the condition that makes both intelligible.
—
This essay forms part of an ongoing research series exploring identity, authority, and governance in digital systems.
Explore the work:
SILT Core specification and documentation:
Technology, governance, and identity projects:
https://www.garethfarry.com/technology
The Release: