LinkedIn · English · original published post
It is a strange world when the Pope speaks more clearly about AI than some people in tech.
It is a strange world when the Pope speaks more clearly about AI than some people in tech.
Pope Leo XIV recently made a simple but important point:
“Machines are tools, not persons.”
The future of AI depends on our choices. And if a system causes harm, responsibility cannot disappear behind a faceless technical entity.
This should be at the centre of the recent debate in Estonia around agent identity codes and digital identities.
For me, we are looking at the question from the wrong end.
The main question is not how to give an agent an identity.
It is how a person or company gives software a specific, limited right to act on their behalf - and how we later establish:
• whose behalf it acted on; • what it was authorised to do; • which data and systems it could access; • who granted the authority; • how it can be revoked; • and who is responsible when something goes wrong.
An identity code alone solves almost none of this.
You may see that an agent is connected to Priit. But without key-bound authorisation, a clear scope, audit logs, and the ability to stop a specific agent or access right, there is no real chain of accountability.
There is simply another register.
This was also the core point in an analysis by Nodachi a few weeks ago. The proposed framework discusses digital identity, but it registers the person - not the individual agent or its concrete permissions.
What remains unclear is what matters most: scope, revocation, logs and liability.
Interestingly, both sides broadly want the same thing:
Limited, auditable and revocable authority for an agent.
Visibility into what it did.
And a responsible person or company behind it.
The disagreement is mostly about the instrument: build a new state-run identity system, or apply existing technical and legal principles more precisely?
My view: we should not give agents personhood or speak about them as new citizens.
An agent is not a person.
It cannot carry moral or legal responsibility. It cannot compensate for harm. And it should not become a convenient entity behind which a founder, manager, company or public institution can hide its decisions.
That does not mean agents should be anonymous. The state may have an important role in establishing trusted links to the responsible party, and standards for verifying whether an authorisation is valid.
But an identifier is not the solution.
Before inventing another code, agree on the basics:
1. What can the agent do? 2. On whose behalf? 3. Under which authority? 4. How is that authority revoked? 5. What trace remains? 6. Who is accountable for harm?
If we cannot answer these questions, an identity code does not make the system safer. It simply puts a new label on a messy system.
The machine can do the work.
The responsibility must remain with the human.