Principal
The principal is the natural or legal person on whose behalf an AI agent acts and who granted it the mandate.
Without a named principal it remains open to whom an action is attributable. In the verification model, a mandate without a principal is therefore not fully proven. The principal may be identified through KYC, an e-ID or a commercial register; the mandate connects them to the agent.
Example
Sample Ltd deploys a purchasing agent. The mandate names Sample Ltd as principal; every order of the agent is attributed to it. A merchant can verify that the agent really acts for Sample Ltd.
How it differs
The issuer signs the mandate; the principal is the person or organization the agent acts for. They are often identical, but not always: a service can issue mandates on behalf of its customers.
In practice
- Name the principal in the mandate unambiguously, for example with a DID or an organization identifier, not only with a name that can be ambiguous.
- Bind the agent to the principal technically, for example through key binding. Otherwise anyone who holds the mandate can appear on behalf of the principal.
- For payments or dealings with authorities, check whether proof of the principal's origin is needed, and then require it explicitly.
Role in KYA
KYA checks whether agent and principal are clearly linked in the evidence, for example through key binding or a delegation chain. Without this link, it remains open on whose behalf the agent acted.
Related check: Agent and principal (subject_agent_binding). Do all parts name the same agent, is the principal named, does the agent hold the bound key?
Frequently asked questions
Who is the principal of an AI agent?
The person or organization on whose behalf the agent acts and to whom its actions are attributed.
Does the principal have to be identified?
That depends on the use case. For payments or dealings with authorities, a proven principal is often needed, for example through a government credential such as the e-ID.
Can an agent have several principals?
An agent can hold several mandates, each with its own principal. For every action it must be clear under which mandate it takes place.
Can a company be a principal?
Yes. A principal can be a person or an organization. For companies, it matters who may issue mandates on behalf of the organization.
How does a verifying party recognize the principal?
From the mandate that names the principal and from the binding between mandate and agent, for example through key binding. If the principal is also proven by an identity credential, its origin can be verified too, without revealing all personal details.