Estonia Wants to Give AI Agents Government-Issued IDs — With Spelled-Out Permission Scopes

Estonia has a plan to solve one of the messier problems in agentic AI: nobody knows who authorized the agent, or what it's actually allowed to do.

The country's AI Council is proposing government-issued digital identities for AI agents. Not metaphorical ones. Actual verifiable credentials, backed by the Estonian state, that define an agent's permission scope before it acts on anyone's behalf.

Estonian Prime Minister Kristen Michal put it plainly: "It must be clear who is acting, on whose behalf, with what rights, and who is responsible." Hard to argue with that framing. It's essentially an OAuth scope list printed on the digital equivalent of an ID card — read-only, document creation, payment authorization up to a defined ceiling. The scope is the point.

This matters because the authorization problem in agentic AI is real and underappreciated. An agent that can browse, sign, and pay is a powerful lateral-movement surface if its delegated rights are vague or unverifiable. Prompt injection attacks already exploit the gap between what a user thinks an agent can do and what it will actually do when fed adversarial input. A cryptographically bound, auditable identity doesn't eliminate that risk, but it narrows the blast radius considerably.

Estonia is not starting from zero here. Estonians already use national digital ID cards for voting, signing legal documents, and pulling medical and tax records. The country's e-residency program extends a version of that infrastructure to foreigners who want to incorporate and operate Estonian companies entirely online. Bolting an agent-identity layer onto that existing stack is architecturally plausible in a way it simply wouldn't be in countries that still fax things.

Vendors have floated agent-identity schemes before. The existing proposals are enterprise-scoped — internal orchestration, platform-to-platform handoffs — and none carry government weight. Estonia's proposal would be the first with a sovereign signature on it.

Michal launched the AI Council in January, tasking it with pushing AI adoption across industry, healthcare, education, and energy. The agent-ID proposal is one output of that effort. No timeline is firm yet, but the Prime Minister is openly angling for first-mover status.

Whether the scheme survives contact with actual agentic deployments is a different question. Defining permission scopes in a credential is straightforward. Enforcing them at runtime, across third-party APIs and LLM tool-call chains, is where the hard engineering lives. Still, as policy interventions go, this one is aimed at the right layer.