An engineer ships an agent to manufacturing. It must name an inside API, so it makes use of the important thing already sitting within the engineer’s setting. The agent runs. It additionally now holds each permission that engineer holds.
That’s the default state of most agent deployments immediately. The agent has no identification of its personal, so it borrows one. Normally it borrows a human’s, by way of an API key. The agent works on day one, which is precisely why the issue ships to manufacturing unnoticed.
What inheritance really prices you
4 failures comply with from that single shortcut, they usually compound.
You get privilege escalation. A non-human course of now carries a human’s full entry. It might attain each system the human can attain, whether or not the duty wants it or not.
You get no scoping. The agent ought to contact a slim slice of your methods. As an alternative it will get all the pieces, as a result of the important thing was by no means meant to specific “solely this.”
You get no attribution. When the agent acts, the audit log exhibits the human. You can not separate what the agent did from what the particular person did. Incident response slows to a crawl, and so does any compliance story you need to inform later.
You get no clear revocation. To close the agent off, you rotate the human’s key. Now you will have damaged the human’s personal entry and each different course of that relied on that key. There is no such thing as a off change for the agent alone.
A educated reader will attain for the apparent fixes right here. Rotate the important thing on a schedule. Hand the agent a service account as an alternative. Each miss the actual drawback.
A passport is the improper psychological mannequin
The intuition is to deal with identification as a passport. A passport authenticates who you might be and maps you to a set set of permissions. Present it on the border, get the entry that comes with it. That mannequin works when habits is predictable inside these permissions. A human with learn entry to a dataset reads the dataset. A service account that posts to a queue posts to the queue, on the identical cadence, each time.
Brokers break the idea beneath the passport. The precise query is just not “who is that this actor.” It’s “what is that this actor licensed to do proper now, for this activity.” That’s authority, not identification within the passport sense, and the distinction is the entire level.
Right here is why it issues. An agent is non-deterministic. Give two brokers the identical permissions and the identical objective, they usually can take totally different actions, as a result of every one picks its software chain at runtime primarily based on its immediate, its context, and the output of no matter referred to as it. The set of actions an agent will really take is just not knowable whenever you grant its permissions.
That turns design-time least privilege right into a design-time reply to a runtime drawback. You’re deciding, prematurely, what an actor could do, when the actor itself decides what to do solely as soon as it’s working. A static grant can not sustain with an actor whose habits shifts on each interplay.
Why your IAM stack does this to you
This isn’t a configuration mistake. It’s a structural assumption baked into identification and entry administration. The methods you run assume an actor is considered one of two issues: an individual, or a long-lived service account with a static permission set. Each are secure. Each do roughly the identical factor each day. Your controls, your audit mannequin, and your provisioning flows are all constructed on that stability.
Brokers are neither. They act on behalf of individuals, so they aren’t service accounts. They’re software program that spins up and tears down by itself schedule, so they aren’t individuals. They sit within the hole your IAM stack doesn’t have a class for, and the hole is the place the credential will get borrowed.
The take-away
In case your brokers authenticate because the people who deployed them, you will have a privilege-inheritance drawback in manufacturing proper now. Discover it earlier than an auditor or an incident does: search for human API keys being utilized by non-human processes, and for audit logs the place you can’t inform agent actions from human ones.
The shallow repair is to cease sharing keys. The actual repair is more durable. A non-deterministic actor can’t be ruled by a static, design-time grant, which implies the agent wants an identification constructed for authority that’s determined at runtime, not a passport stamped as soon as on the border.
That raises the apparent query. If the agent wants its personal identification, what’s that identification really manufactured from, and is it something greater than the workload identification you already run? That’s the subsequent put up.
