Executive briefing · August 2026
Who Can Act For Your Clients?
AI, authority and evidence across the client estate — an executive briefing for MSPs and MSSPs.
- Published
- August 2026
- Length
- 22 pages plus cover
- Reading time
- 6 minutes to the decision · 18 minutes to the architecture
The first two pages stand alone. If you read nothing else, you will have the decision. The rest is for whoever you forward it to.
- What machine is acting?
- Who authorised it?
- Can it be revoked?
- What evidence exists?
The typeset edition is not out yet
It is being produced from real production artefacts rather than mockups, which is slower and is the reason there is no download button on this page today. We are not going to illustrate a briefing about verifiable records with pictures of a product that does not exist.
The argument itself is readable now, in full and for free, with no email address:
Contents
What is in it
Eight parts. The first two stand alone for a reader who has six minutes; the rest is written for whoever they forward it to.
Part I
What changed, and when
The dated shift — machine actors arriving inside MSP tooling by vendor decision, and managed service providers arriving inside cyber regulation, in the same quarter. Each event with its primary source.
Part II
Why it lands on you
The cross-customer multiplier: why an accountability surface that is manageable for a single enterprise multiplies by customer count for a provider, and why enterprise governance frameworks do not assume your shape.
Part III
The four questions
What machine is acting, who authorised it, can it be revoked, and what evidence exists — where each one currently gets answered, and where it does not.
Part IV
Identity is not authority
Why an agent identity, an authenticated token and a platform permission are three different objects, and why none of them records what a customer authorised.
Part V
The architecture
The two-grant model, the subset invariant, assurance states, lifecycle and revocation semantics, and what an evidence reference does and does not prove.
Part VI
The proof
The Machine Trust Register, customer authority and confirmation, Attention Required, the Evidence Pack, and the resolver views a customer can check without going through you.
Part VII
The service you can sell
How the capability attaches to an existing managed services agreement, what the client receives, and the commercial structure — including what we will not put a number on.
Part VIII
Fit, and honest exclusions
Who this is for, who it is not for yet, the published qualification criteria, and what the £395 Client-Estate Machine Trust Audit produces.
Get told once
Send it to me when it is published
What is deliberately not in it
- No market-size projection.
- No return-on-investment calculation, payback period or attach rate.
- No customer count, partner count or waitlist number.
- No claim that any regulation requires ECZ-ID.
- No statistic we have not read the original of.
- No case study, because we do not yet have one we could tell honestly.
Public category. Private activation.
Anyone may read this site and run the free check. Commercial activation is by application, and the criteria are published.