HKMA's Project SAGE takes on AI agent identity and delegated authority

The Hong Kong Monetary Authority's Project SAGE is exploring how AI agents should be identified and how authority should be delegated to them, according to a report from OpenTools.

The question is not abstract. Once an AI agent starts initiating payments, checking balances, filing applications or calling bank interfaces on someone's behalf, the system has to answer two things first: whom the agent actually represents, and what it is permitted to do.

Identity addresses verifiability. An agent needs an origin marker that a counterparty can confirm, rather than a credential anyone could copy. Delegated authority addresses scope: permissions need to be bounded to a specific account, a specific limit and a specific scenario, and they need to be traceable and revocable.

For banks and supervisors, both pieces have to hold before agents can move into production at scale. Otherwise, when something goes wrong, responsibility becomes hard to assign: was the user's instruction mistaken, did the agent exceed its mandate, or did the institution's controls fail to stop it?

Project SAGE matters because it shifts the conversation from whether agents can be used to under what identity and on what authority they are used. That is the layer financial institutions cannot easily route around, and the layer where standards and supervision are most likely to diverge.

Public information so far suggests the work remains at an exploratory stage. What to watch is whether it settles into concrete frameworks for banks, such as how agent identities are registered, how delegated permissions are described, and how institutions recognise each other's arrangements.