Agents Are Accumulating Cloud Credentials Faster Than Humans Ever Did
Every new automation gets a key, and almost none of them get revoked. Non-human identity is now the largest ungoverned population in the estate.
Human joiners and leavers are governed: there is a process, an owner, and a quarterly review. Agent identities have none of that. They are created by whoever is building the automation, in whatever account has room, with whatever permissions made the prototype work on a Friday afternoon.
How the sprawl builds
- A pilot needs read access, so it gets a broad read role because scoping takes an afternoon nobody has.
- The pilot succeeds and moves to production with the pilot's credentials.
- Two more agents are built on the same service account, because it already works.
- The engineer who created it changes team. The credential has no owner and no expiry.
- A year later nobody can say what breaks if it is revoked, so it is not revoked.
Why this is worse than a stale human account
A dormant human account is dormant. An agent credential is in constant legitimate use, so "unused key" reports never flag it, and its behaviour is automated — meaning a compromise looks exactly like normal operation, at machine speed, at three in the morning.
What good looks like
1. A registry with a named human owner
Every non-human identity has an owner, a purpose, an expiry date and a business service it belongs to. No entry, no credential.
2. Short-lived credentials only
Workload identity federation and issued tokens instead of static keys. A leaked token that expires in an hour is an incident; a leaked static key is a breach.
3. Permissions from observed use
Grant broadly in a sandbox, record what the agent actually calls, then generate the scoped policy from that evidence and enforce it in production.
4. Behavioural baselines per identity
Agents are more predictable than people. That makes deviation — a new region, a new API, a new data volume — a strong and cheap signal.
5. Expiry as the default
Every agent credential expires. Renewal requires the owner to confirm it is still needed. This alone removes most of the population within two cycles.
The estate's largest identity population has no HR system behind it. Build one, or accept an unbounded, unowned key set.
