AI Agents Should Never Self-Assign Identity in Tool Calls, Security Analysis Warns

A technical analysis published on DEV Community argues that AI agents must never be allowed to determine or insert their own acting identity into tool calls, as doing so conflates untrusted model output with verified authorization. The piece explains that any given agent invocation involves at least three distinct identities — the requesting human, the agent service, and the business subject — which cannot be assumed to be the same entity. Allowing a model to populate a user_id or similar field in tool arguments creates a critical security gap, since the model cannot cryptographically prove authentication, delegation, or authorization. The author notes that even a well-aligned model is vulnerable to prompt injection, hallucination, or stale context that could cause it to select an incorrect or elevated identity. The recommended approach is to separate model-controlled business arguments from trusted, system-bound identity context supplied through verified sessions, signed tokens, or enterprise identity providers.