Identity and Authorization
Every agent a distinct, governable principal with an authorization model that is enforceable and auditable.
Objective
Every agent is a distinct, governable principal with an authorization model that is enforceable and auditable.
Minimum bar (L2). One identity per agent deployment, with no shared service accounts across agents. A documented lifecycle covering registration, approval, issuance, review, and deprovisioning. Agent identities included in access review cycles at the same cadence as privileged human accounts11—or more frequently, given their number and rate of change.
7.1 Controls #
| ID | Control | Minimum bar (L2) | Enforced state (L3) |
|---|---|---|---|
| AUTH-1 | Task-scoped delegation | Each agent’s authorization scope is documented and tied to a specific business function rather than granted at role level, and the invoking principal is recorded on every action. Standing authority is permitted only where it is declared in the registry and reviewed at the same cadence as privileged human access. | Task-scoped delegation: the agent acts with authority derived from and bounded by the invoking principal, not with standing authority of its own. |
| AUTH-2 | Inspectable delegation chains | Every multi-agent workflow documents at design time which agent may invoke which, and what authority passes at each hop. Sub-agent invocation is logged in sufficient detail to reconstruct the chain after the fact, even where the constraint is not yet enforced at runtime. | Explicit, inspectable delegation chains. When agent A invokes agent B, the authority passed is recorded and constrained; B never inherits more than A held. |
| AUTH-3 | Automated deprovisioning | Documented deprovisioning triggers—owner departure, project closure, a defined inactivity threshold—executed on a scheduled review. Deprovisioning means credential revocation and principal deletion, not a disabled flag on a principal that still exists. | Automated deprovisioning tied to owner departure, project closure, or inactivity thresholds. |
| AUTH-4 | Separation of identity planes | The agent’s authentication identity is distinct from the human principal whose entitlements scope its access, and neither is satisfied by a shared workload credential. Where the planes are currently collapsed, each instance is inventoried and carries a remediation owner and target date. | Separation of identity planes: the agent’s identity for authentication, the human’s for authorization scope, the workload’s for infrastructure access—never collapsed into one credential. |
7.2 Evidence to Request #
- Access review records covering agent identities.
- A delegation chain trace for a representative multi-agent workflow.
- Deprovisioning logs showing agents actually removed, not just marked inactive.
7.3 Failure Modes #
- Agents provisioned during a pilot with broad roles, never re-scoped after production launch.
- Legacy agents issued under a prior identity model that predates the agent-identity capability, creating a population that appears governed but is not.
- Access reviews that report a single combined figure across human and non-human identities, concealing a much worse NHI posture behind good human hygiene. Report these separately, always.
References cited in this section
1 of 32 · numbering matches the PDF
- 11"2026 SANS State of Identity Threats & Defenses Survey," SANS Institute, March 10, 2026. †www.sans.org/white-papers ↗