Whose credentials is your agent using?

Ask who an agent is, as far as your access logs are concerned, and the answer is usually one of two. Either it runs as the person who set it up, with their token pasted into a configuration file, or it runs as a service account created in a hurry and given broad rights so that it would stop getting blocked.

Both answers are understandable and both are wrong in the same way. The agent’s reach becomes something nobody designed, and the log starts saying things that are not true.

The two common answers

Running as a person. The agent inherits everything that person can do, including everything its task never needs. The log attributes the agent’s actions to someone who did not take them. When that person changes role or leaves, the agent either breaks or, worse, keeps access it should have lost along with them.

Running as a shared service account. One identity serves every user. The agent can reach every customer’s records on behalf of any customer, so a user who persuades it, or content that manipulates it, can reach data that user was never entitled to see. This is the old confused deputy problem: a program with authority of its own, acting on a request from somebody with less.

Neither problem is new, and neither needs anything specific to AI to fix. What is new is that the program in the middle can now be talked into things.

What an agent identity should look like

Its own identity, with an owner. Registered, named, accountable to a person, and appearing in logs as itself. If you cannot switch the agent off without switching off a human, it does not have one.

On behalf of, not instead of. For each task, the effective permission is the intersection of what the agent may do and what the user it serves may do. The downstream system sees both — this agent, for this user — and checks both. Delegation flows in common identity platforms exist for exactly this.

Scoped to the task and short-lived. A token to read one mailbox for the next quarter of an hour, not a key to the mail system that stays valid until someone remembers to rotate it. When a credential leaks, its expiry sets the size of the incident.

Credentials never in the context. The model never sees a secret. The tool runtime holds credentials and attaches them to calls; the model only asks for an operation. A key in the prompt is a key in every trace, every log, and every reply the model can be persuaded to write.

Revocable in one place. Disabling the agent is one action against one identity, not a search for keys copied into five configuration files.

Infographic

From borrowed keys to delegated access

Shared admin accountA person's own tokenAgent's own accountOwn identity, per-user scopeShort-lived per-task token

Borrowed authorityDelegated, scoped

Authority only shrinks along a chain

When agents call agents, the same question returns at every hop. The orchestrator should pass a sub-agent the narrowest authority its part of the task needs, still tied to the original user, rather than its own full rights. A sub-agent that only summarises documents should be unable to send anything, whatever the orchestrator asks of it.

A request from another agent is also not an instruction from the user. It carries no more authority than the content that produced it. If the orchestrator read an untrusted web page before delegating, the delegation was shaped by that page, and the permissions further down the chain should assume so.

Where to start

Make a list. For every agent in production or in pilot, write down which identity it runs as, what that identity can reach, what the agent actually uses, and who can switch it off. The gap between the second and third columns is your exposure. The fourth column is your incident response.

It is a short exercise. Often the list does not exist yet, which is a finding in itself. Then take the agent with the widest gap and fix that one first; the pattern you build for it becomes the template for the rest.

Cheap now, expensive later

Agent identity costs little to get right at design time and a great deal to retrofit, because by then other systems depend on the shortcut. In an AI agents engineering engagement, the identity and its permissions are part of the boundary definition: settled before the first tool is built, rather than discovered during the first incident.