Estonia Wants to Give AI Agents Government-Issued IDs — With Spelled-Out Permission Scopes

Key points

• Estonia's AI Council wants government-issued digital identities for AI agents, specifying each agent's permission scope before it acts.
• Prime Minister Kristen Michal says agents must show who is acting, on whose behalf, and who is responsible.
• Allowed actions could include viewing data, editing documents, or making payments up to a set limit.
• Estonia already runs national digital ID infrastructure for voting and legal signing, making the extension architecturally plausible.
• No firm timeline exists, but Michal is openly pursuing first-mover status.

Estonia has a plan to solve one of the messier problems in agentic AI: nobody knows who authorized the agent, or what it's actually allowed to do.

The country's AI Council is proposing government-issued digital identities for AI agents. Not metaphorical ones. Actual verifiable credentials, backed by the Estonian state, that define an agent's permission scope before it acts on anyone's behalf.

Prime Minister Kristen Michal put it plainly: "It must be clear who is acting, on whose behalf, with what rights, and who is responsible." Hard to argue with that framing. It's essentially an OAuth scope list printed on the digital equivalent of an ID card: read-only access, document creation, payment authorization up to a defined ceiling. The scope is the point.

Should you worry about the authorization gap?

The authorization problem in agentic AI is real and underappreciated. An agent that can browse and pay is a powerful lateral-movement surface if its delegated rights are vague or unverifiable. Prompt injection attacks already exploit the gap between what a user thinks an agent can do and what it will actually do when fed adversarial input. Our 28 May story "You Can't Audit What You Can't See" found enterprises shipping agents into production without inventories or trace pipelines. A cryptographically bound, auditable identity doesn't eliminate that risk, but it narrows the blast radius considerably.

Estonia is not starting from zero. Estonians use national digital ID cards for document signing, tax records, and medical access. The e-residency program extends a version of that infrastructure to foreigners incorporating Estonian companies entirely online. Bolting an agent-identity layer onto that existing stack is architecturally plausible in a way it simply wouldn't be in countries that still fax things.

What makes this different from vendor proposals?

Vendors have floated agent-identity schemes before. Those proposals are enterprise-scoped, covering internal orchestration or platform-to-platform handoffs, and none carry government weight. Estonia's proposal would be the first with a sovereign signature on it.

Michal launched the AI Council in January, tasking it with pushing AI adoption across industry, healthcare, education, and energy sectors. The agent-ID proposal is one output of that effort.

Defining permission scopes in a credential is straightforward. Enforcing them at runtime across third-party APIs and LLM tool-call chains is where the hard engineering lives. Still, as policy interventions go, this one is aimed at the right layer.