The earlier publish left you with a borrowed credential and a non-deterministic actor {that a} static grant can’t govern. The repair is to cease borrowing. Give the agent a steady, verifiable runtime principal you possibly can authorize towards, attribute actions to, and revoke by itself.
That sentence hides 4 necessities. Pull them aside.
The 4 issues an agent identification wants
A definite principal. The agent is its personal actor, not a human it impersonates and never a shared service account it hides inside. Its actions resolve to it.
Scoped permissions. The grant is narrower than any human’s, sized to the duty, to not the one that launched it. Scope is the reply to the non-determinism downside from Half 1: you can not predict each motion, so that you certain the house the agent can act in.
A transparent proprietor. Each agent traces again to an individual or staff accountable for it. An identification with no proprietor is a legal responsibility with no identify on it.
A kill swap. You possibly can revoke the agent with out touching anybody else’s credentials. Unbiased revocation is what makes the identification secure handy out within the first place.
Miss any certainly one of these and you’re again in Half 1. The alternate options engineers attain for first every miss no less than one.
| Strategy | Actor mannequin | Attribution | Scoping | Revocation | The place it breaks |
|---|---|---|---|---|---|
| Shared service account | One identification, many brokers | None: all brokers look an identical | Coarse, shared by all | Revoke one, you revoke all | No strategy to inform brokers aside or shut one off |
| Per-user impersonation | Agent borrows a human | Logs present the human, not the agent | Inherits the human’s full entry | Rotating the important thing breaks the human | The Half 1 downside, by one other identify |
| Static secret | A protracted-lived key | Tied to a secret, not an actor | Regardless of the secret was minted for | No rotation, no clear revocation | Secret leaks, lives eternally, scopes nothing |
| First-class agent identification | A definite principal | Actions resolve to the agent | Job-scoped, narrower than a human | Unbiased kill swap | Value of operating it as actual infrastructure |
Desk 1. The identical 4 questions, requested of each choice folks strive earlier than they offer the agent its personal identification.
The query a great engineer is already asking
If the agent will get a steady runtime principal with scoped permissions and a kill swap, you’ve gotten described workload identification. So is agent identification simply workload identification with a brand new label?
It is a dwell debate, not a settled level, and the trustworthy reply is: it relies upon. It will depend on three invariants.
A one-to-one mapping. One agent corresponds to precisely one workload. When that holds, the workload’s identification is the agent’s identification.
A registry because the supply of reality. One thing authoritative data which brokers exist and what they’re. With out it, you can not motive in regards to the inhabitants of brokers, solely about particular person processes.
Identification continuity. The identification survives restarts, pauses, and reschedules. The agent that comes again up is provably the identical agent that went down.
When all three maintain, agent identification collapses into workload identification. You attest the workload with one thing like SPIFFE or WIMSE and also you authorize towards it straight. No further layer earns its place.
Once they break, agent identification turns into a layer on high of workload identification. They usually break usually. Brokers are bursty. They’re ephemeral. They churn throughout workloads as an alternative of pinning to at least one. They spawn sub-agents that don’t have any workload of their very own to attest. The one-to-one mapping dissolves, continuity will get arduous, and the workload is now not a trustworthy stand-in for the agent.
What the delivery platforms inform you
The publicly introduced platforms present the layered sample in manufacturing. Microsoft Entra Agent ID introduces a specialised principal that extends an present listing, quite than reusing a plain workload identification. AWS Bedrock AgentCore exposes a steady agent identification that sits above a sandboxed workload, which may churn beneath with out the agent’s identification churning with it.
Discover what each share. Every lives inside a single management aircraft and a single belief area. One system points the identification, governs it, and may see each hop the agent makes, as a result of each hop occurs on house turf. That’s what makes the layered mannequin tractable for these platforms.
Maintain that remark. It’s doing extra work than it seems like, and it’s the assumption that breaks in Half 4.
The take-away
An agent identification is a steady runtime principal with its personal scoped permissions, a transparent proprietor, and an off swap. Whether or not that’s plain workload identification or a layer above it isn’t a matter of style. It will depend on whether or not you possibly can maintain the one-to-one mapping, a registry as supply of reality, and continuity throughout the agent’s life. Audit your individual brokers towards these three invariants. The place they break is the place you want the additional layer, and the place most actual fleets dwell.
You now have a single agent with an identification. Actual techniques will not be single brokers. A person calls an agent, the agent calls a software, the software calls one other agent, and the identification has to outlive each hop. The following publish is about what occurs to identification in that chain, and the protocols that both protect it or destroy it.
