Machine Identity Is the Bottleneck for Safe AI Agents
Agents now outnumber employees in many identity directories, and they authenticate with long-lived secrets nobody rotates. Identity, not the model, is where agent security will be won or lost.
Ask an identity team how many non-human identities they manage and the number is usually wrong by an order of magnitude. Agents create service accounts, service accounts create tokens, tokens outlive the project, and none of it appears in the joiner-mover-leaver process that governs humans.
Why agent identity is harder than service identity
A traditional service does one thing, forever, with a fixed set of calls. An agent acts on behalf of different humans, in different contexts, with a set of actions decided at runtime by a model. Static role assignment cannot express that, so teams over-grant and move on.
The four properties an agent credential needs
1. Short-lived and workload-attested
No long-lived secrets in configuration. The runtime proves what it is, receives a credential measured in minutes, and cannot export it.
2. Delegation that is visible downstream
The receiving system must be able to see both the agent and the human principal it is acting for. "Service account X did it" is not an audit trail when X acts for four thousand people.
3. Task-scoped authority
Permissions bound to the current task, not to the agent in general. An agent handling a refund request should hold refund authority for that ticket, for that amount, for that window — and nothing else once the task ends.
4. Revocation that actually takes effect
A kill switch that invalidates in seconds across every downstream system. Most environments today can disable an account but cannot stop tokens already issued.
Getting there without a two-year programme
- Start with an inventory keyed on credential, not on account. One account with nine tokens is nine identities.
- Set a maximum lifetime and enforce it by expiry rather than by policy documents.
- Route agent access through a broker that mints task-scoped credentials, so the agent never holds a durable secret.
- Add the human principal to every log line at the broker, which is far cheaper than retrofitting it into every downstream system.
- Run an access review for non-human identities on the same cadence as the human one. The first pass typically removes a third of the grants.
Model guardrails limit what an agent will try. Identity limits what it can actually do. Only one of those is enforceable.
