When an agent uses an employee's credentials, or a single powerful key shared across systems, you can't tell who did what, and any compromise has wide reach. Treat each agent as a distinct actor.
Principles
- One identity per agent, with its own credentials and an owner.
- Least privilege — scopes limited to the tasks it performs, reviewed regularly.
- Short-lived credentials where possible, rotated and stored in a secrets manager.
- Attribute actions — logs that record agent, task, tool, inputs and the human who initiated it.
- Revocation — a quick way to disable one agent without affecting others.
If you can't answer 'what did this agent do last Tuesday, and on whose behalf?', its identity design is not finished.