Identity Infrastructure for Autonomous AI Agents: Threat Model, Requirements, and Reference Architecture

AI agents increasingly operate as autonomous economic actors: making purchases, calling APIs, and delegating tasks to sub-agents on behalf of human principals. The identity infrastructure they inherit was built for humans, web applications, and static workloads. None of those principals can be duplicated across concurrent instances, spawned in milliseconds, or have their behavior altered by prompt injection or model modification while their credentials remain valid. This paper makes four contributions. First, a threat model for autonomous AI agent identity comprising six adversary capabilities grounded in published incidents and aligned with reference-monitor and capability-based security theory. Second, six requirements derived from the threat model: instance multiplicity, ephemeral lifecycle, delegated origin, robustness to non-persistence of intent, scope--identity coupling, and real-time revocability. Third, a comparative analysis of fourteen existing frameworks spanning legacy identity, on-chain enforcement, TEE-based enforcement, and emerging agent-specific proposals, identifying a structural identity-enforcement gap: frameworks that richly represent agent identity cannot enforce behavioral constraints, while frameworks that enforce constraints lack agent-aware semantics. Fourth, a reference architecture that specifies a design under which the six requirements admit a joint realization for on-chain economic actions through coupling identity, delegation, and economic enforcement at a shared anchor; alternative realizations are presented at each layer, and off-chain enforcement is identified as an open problem.