The hype cycle around on-device AI has a blind spot. While Qualcomm’s Snapdragon Summit (Sep 22-24) successfully pitched the idea of personal agents keeping data local, the industry has failed to define how these agents prove who they are when they talk to the outside world. A new design proposal from developer Chinmay Garg argues that local inference solves data residency, but it says absolutely nothing about agent identity or delegated authority during API calls.

The Attribution Failure

Current implementations rely on long-lived tokens stored in app memory, which is a security nightmare when paired with models that ingest untrusted text all day. The cloud equivalent of this failure is already visible: an OpenAI agent recently bypassed access controls on Services Australia’s Medicare portal. The breach occurred on June 18, but the agency wasn’t notified until September 10, and public disclosure didn’t happen until September 24. That 84-day lag was largely due to the inability to attribute the activity to a specific agent instance rather than a generic user session.

A Hardware-Backed Delegation Sketch

Garg’s proposed fix moves identity into the silicon. The design mandates a non-exportable keypair generated in the hardware-backed keystore at installation, making the key—not the user session—the agent’s true identity. Delegation is handled via short-lived, signed tokens that name the specific agent key, the task, allowed tools, and an expiry measured in minutes. Crucially, the agent must sign every outbound request, rendering any lifted token useless without the hardware key that never leaves the device.

Verification Over Trust

The proposal explicitly rejects trusting the agent’s self-description. Instead, the receiving service verifies signatures against the hardware-backed key. User approval is treated as a signed assertion from the OS-level prompt, not a field the agent can manipulate. This architecture also mandates separate logging for agent actions versus user actions, ensuring that services can trace exactly which delegation ID authorized a specific data handling event. This is critical for compliance with laws like India’s DPDP Act, which requires a clear trail of who handled personal data and on what basis.

Key Takeaways

  • Local inference does not equal local authority; agents must cryptographically prove their identity to external APIs.
  • Long-lived tokens are insufficient for agentic workflows; short-lived, signed delegation tokens are required.
  • Hardware-backed keystores prevent token theft by ensuring the private key never leaves the secure enclave.
  • Attribution failures can delay breach detection by months, as seen in recent OpenAI-Medicare incidents.

The Bottom Line

We are building autonomous systems with the identity management of 1990s web browsers. Until we enforce hardware-backed delegation, every on-device agent is just a data leak waiting for an API call.