The earlier put up left you with a borrowed credential and a non-deterministic actor {that a} static grant can’t govern. The repair is to cease borrowing. Give the agent a steady, verifiable runtime principal you possibly can authorize in opposition to, attribute actions to, and revoke by itself.
That sentence hides 4 necessities. Pull them aside.
The 4 issues an agent identification wants
A definite principal. The agent is its personal actor, not a human it impersonates and never a shared service account it hides inside. Its actions resolve to it.
Scoped permissions. The grant is narrower than any human’s, sized to the duty, to not the one who launched it. Scope is the reply to the non-determinism downside from Half 1: you can not predict each motion, so that you certain the area the agent can act in.
A transparent proprietor. Each agent traces again to an individual or staff accountable for it. An identification with no proprietor is a legal responsibility with no identify on it.
A kill swap. You’ll be able to revoke the agent with out touching anybody else’s credentials. Unbiased revocation is what makes the identification secure at hand out within the first place.
Miss any one in every of these and you’re again in Half 1. The alternate options engineers attain for first every miss at the least one.
| Strategy | Actor mannequin | Attribution | Scoping | Revocation | The place it breaks |
|---|---|---|---|---|---|
| Shared service account | One identification, many brokers | None: all brokers look similar | Coarse, shared by all | Revoke one, you revoke all | No method to inform brokers aside or shut one off |
| Per-user impersonation | Agent borrows a human | Logs present the human, not the agent | Inherits the human’s full entry | Rotating the important thing breaks the human | The Half 1 downside, by one other identify |
| Static secret | A protracted-lived key | Tied to a secret, not an actor | Regardless of the secret was minted for | No rotation, no clear revocation | Secret leaks, lives eternally, scopes nothing |
| First-class agent identification | A definite principal | Actions resolve to the agent | Job-scoped, narrower than a human | Unbiased kill swap | Value of operating it as actual infrastructure |
Desk 1. The identical 4 questions, requested of each possibility folks strive earlier than they provide the agent its personal identification.
The query a superb engineer is already asking
If the agent will get a steady runtime principal with scoped permissions and a kill swap, you’ve gotten described workload identification. So is agent identification simply workload identification with a brand new label?
This can be a reside debate, not a settled level, and the sincere reply is: it relies upon. It depends upon three invariants.
A one-to-one mapping. One agent corresponds to precisely one workload. When that holds, the workload’s identification is the agent’s identification.
A registry because the supply of fact. One thing authoritative data which brokers exist and what they’re. With out it, you can not purpose concerning the inhabitants of brokers, solely about particular person processes.
Id continuity. The identification survives restarts, pauses, and reschedules. The agent that comes again up is provably the identical agent that went down.
When all three maintain, agent identification collapses into workload identification. You attest the workload with one thing like SPIFFE or WIMSE and also you authorize in opposition to it immediately. No additional layer earns its place.
After they break, agent identification turns into a layer on high of workload identification. And so they break usually. Brokers are bursty. They’re ephemeral. They churn throughout workloads as an alternative of pinning to 1. They spawn sub-agents that haven’t any workload of their very own to attest. The one-to-one mapping dissolves, continuity will get arduous, and the workload is not a devoted stand-in for the agent.
What the transport platforms inform you
The publicly introduced platforms present the layered sample in manufacturing. Microsoft Entra Agent ID introduces a specialised principal that extends an present listing, relatively than reusing a plain workload identification. AWS Bedrock AgentCore exposes a steady agent identification that sits above a sandboxed workload, which might churn beneath with out the agent’s identification churning with it.
Discover what each share. Every lives inside a single management aircraft and a single belief area. One system points the identification, governs it, and may see each hop the agent makes, as a result of each hop occurs on house turf. That’s what makes the layered mannequin tractable for these platforms.
Maintain that commentary. It’s doing extra work than it seems like, and it’s the assumption that breaks in Half 4.
The take-away
An agent identification is a steady runtime principal with its personal scoped permissions, a transparent proprietor, and an off swap. Whether or not that’s plain workload identification or a layer above it’s not a matter of style. It depends upon whether or not you possibly can maintain the one-to-one mapping, a registry as supply of fact, and continuity throughout the agent’s life. Audit your individual brokers in opposition to these three invariants. The place they break is the place you want the additional layer, and the place most actual fleets reside.
You now have a single agent with an identification. Actual methods are usually not single brokers. A consumer calls an agent, the agent calls a software, the software calls one other agent, and the identification has to outlive each hop. The subsequent put up is about what occurs to identification in that chain, and the protocols that both protect it or destroy it.
