Agent Identity & Attribution
How autonomous agent actions are bound to an accountable principal — via dedicated per-agent credentials/identities vs. augmenting the human's existing identity with agent/session context — and the security tradeoffs between the two approaches.
Also known as: agent identity, non-human identity, service account (for agents), agent credentials, dedicated agent identity, Entra Agent ID, attribution (agent actions)
How authors use it
Oldest first (extraction date when no publication date is known).
| Author | Their term | Their meaning |
|---|---|---|
| When Your Buyer Is an AI Agent Rudrendu Paul and Sourav Nandy · 2026-08-19 | non-human identity (NHI) | A credentialed identity assigned to a software agent (as opposed to a human employee) for the purpose of authentication, authorization, and accountability in enterprise systems; cited as already outnumbering human identities 96:1 (financial services) to 144:1 (general enterprise). |
Documents (6)
- Podcast: Securing AI Agents: Identity, Authorization, and the DPACT Framework Sahil Agarwal · 2026-09-23 source ↗ Reader 🖥️
As AI agents shift from passive chat interfaces to autonomous 'delegated actors' that take real, consequential actions with sensitive data, organizations must replace broad, human-shaped, long-lived tokens with the DPACT framework — Delegation, Policy, Auditability, Context, and Time — so that every agent acts strictly on behalf of, and never as an impersonation of, an accountable human principal, within a bounded, auditable, expiring grant of authority, adopted incrementally rather than as a big upfront program. - Cloudflare Introduces the Agent Development Lifecycle to Replace Traditional SDLC Olimpiu Pop · 2026-09-21 source ↗ Reader 🖥️
Because AI models have made code generation fast, the bottleneck in software delivery has shifted downstream to testing, deployment, and maintenance, so Cloudflare argues the entire SDLC must be rebuilt as an event-driven 'Agent Development Lifecycle' — with Workflows as the orchestration primitive, OpenTelemetry-style observability into agent reasoning, and machine-speed security enforcement (short-lived scoped credentials plus a dynamically-narrowing 'Trust Ratchet') replacing human-paced review gates. - When Your Buyer Is an AI Agent Rudrendu Paul and Sourav Nandy · 2026-08-19 source ↗ Reader 🖥️
As autonomous AI agents increasingly perform the research, negotiation, and (in advanced cases) contracting stages of enterprise B2B procurement on the buyer's behalf, sellers must re-architect their commercial infrastructure — replacing per-seat pricing with outcome-based pricing, replacing relationship-driven sales collateral with machine-readable product data, and replacing human-click checkout with agent-compatible authorization — or risk being screened out of consideration before a human relationship ever begins. - Cloudflare WriteGuard Brings Fine-Grained Security Controls for MCP Servers Sergio De Simone · 2026-08-18 source ↗ Reader 🖥️
A centralized policy, attribution, and auditing layer sitting behind a shared MCP portal can safely upgrade AI agents from read-only to fine-grained, tool-specific write access without requiring per-server code changes or a separate agent-identity system. - GKE Security Blueprint Joins Growing List of Cloud AI Frameworks Matt Saunders · 2026-07-22 source ↗ Reader 🖥️
As AI workloads move from prototype to production on managed Kubernetes, Google, AWS and Microsoft are each publishing layered security blueprints that harden a different part of the stack (infrastructure, identity/observability, and agent identity respectively), but none of these approaches is sufficient alone because neither cloud-native perimeter/identity controls nor Kubernetes itself can reason about semantic, runtime properties of AI behavior — whether a prompt is malicious, a response leaks data, or a permitted action is actually normal for a given agent. - Why Token Handling Must Evolve for AI Agents J Simpson · 2026-04-20 source ↗ Reader 🖥️
Static, session-based access-token models designed for human users are fundamentally unsuited to autonomous AI agents, and must be replaced by runtime, context-aware, short-lived, minimally-scoped token strategies to prevent the class of credential-abuse breaches that already accounts for a fifth of all data breaches.
Propositions touching this concept (4)
By publication month, oldest first (extraction month when no publication date is known).
2026-04
- implicitcontestedAgent identity is a solved or solvable problem — you can reliably distinguish one agent from another and from the human principal it serves.
2026-07
- explicit⚡ disputed & corroboratedMicrosoft secures AI agents primarily through agent identity — Entra Agent ID issues individual agents their own scoped, short-lived credentials — rather than through the underlying container platform, and pairs this with automated red-teaming (PyRIT) to probe agents for weaknesses before release.
2026-08
- implicitcontestedAgent identity and governance are currently inadequate in practice: a documented Claude-based exploit succeeded via an uploaded 'agent file' specifically because the agents involved lacked tracked identity and proper security governance.
2026-09
- explicitAgent governance should be adopted incrementally rather than as a big upfront program: (1) inventory which agents exist, what tools/credentials they use, and what data they access; (2) add visibility (agent ID, task ID, trace ID) and basic audit; (3) separate agent identity from human identity so agents are never handed a human's own token or API key; (4) add human-in-the-loop review for the highest-impact actions; (5) move to continuous authorization that re-evaluates or downgrades scope at each step.
Open gaps (10)
- incompleteThe article never addresses the cold-start problem: none of the five signs work without an established behavioral baseline, and it says nothing about how long a baseline takes to become reliable, what happens during that window for new employees, new customers, or newly provisioned service/agent accounts, or how organizations should treat authenticated traffic from identities with no meaningful history yet.5 Signs That Authenticated API Traffic Is Actually Malicious — read next: Literature on user/entity behavior analytics (UEBA) cold-start handling, and on non-human/workload identity onboarding (service accounts, AI agent credentials) for how baseline-dependent anomaly detection copes with brand-new identities.
- incompleteDPACT is explicitly presented as a 'positional blueprint' with no reference architecture or worked technical spec for how each pillar (especially Time and Auditability) is actually enforced in a real stack — unlike, e.g., AWS Loom's concrete RFC 8693 token-exchange mechanism for preserving a delegation chain, or MCP's Enterprise-Managed Authorisation ID-JAG flow. The framework names the categories of guardrail needed but not the mechanisms.Podcast: Securing AI Agents: Identity, Authorization, and the DPACT Framework — read next: extract-aws-loom-ai-agent-governance (RFC 8693 delegation-chain token exchange) and extract-mcp-centralised-auth-enterprise (ID-JAG flow) for concrete technical primitives that could implement DPACT's pillars.
- illogicalAgarwal insists an agent must never be identified via a human's own credential ('you cannot just be passing the same human tokens to an agent'), yet the corpus documents a shipped production system, Cloudflare WriteGuard, that deliberately identifies the agent via the human's existing OAuth credentials rather than a standalone agent identity, arguing contextual tagging (client, session) is sufficient for accountability. The interview neither engages with nor acknowledges this competing, already-deployed design choice.Podcast: Securing AI Agents: Identity, Authorization, and the DPACT Framework — read next: extract-cloudflare-writeguard-mcp-servers, which argues the opposite position with a shipped implementation.
- uninformedDPACT is not benchmarked or validated against measurable outcomes. Agarwal cites two vivid but small anecdotes (a hiring bot, a food-ordering bot) and a self-applied, informal 'scoring rubric' against unnamed 'famous GitHub repos,' but offers no data on incident rates, breach frequency, or cost with versus without DPACT-style controls.Podcast: Securing AI Agents: Identity, Authorization, and the DPACT Framework — read next: extract-token-handling-ai-agents, whose cited empirical stats (88% of basic web-app attacks involve stolen credentials; one in three AI adopters already breached) would be a natural quantitative complement to DPACT's qualitative case.
- incompleteThe interview never explains who authenticates the agent's own request for a scoped or on-behalf-of grant, or what secures the token-issuing/authorization service itself — the same structural gap already flagged repeatedly elsewhere in this corpus (companion pieces on agent token handling and on privilege drift in multi-agent systems) as agent identity being treated as solved rather than examined. DPACT restates the goal (a first-class on-behalf-of grant) without addressing the bootstrapping problem of how the agent proves it is the agent in the first place.Podcast: Securing AI Agents: Identity, Authorization, and the DPACT Framework — read next: extract-token-handling-ai-agents and extract-privilege-drift-multi-agent-systems, both of which raise this identical unresolved problem — read together to see the gap is now recurring across at least three independent sources in the corpus rather than a one-off omission.
- unstated assumptionNo discussion of the performance and cost implications of per-request token issuance at scale.Why Token Handling Must Evolve for AI Agents — read next: Research on token-service throughput benchmarks and latency budgets for per-call issuance
- biasThe article is partly a promotional vehicle for Curity's Access Intelligence product but does not disclose the commercial relationship or compare alternative solutions.
- incompleteThe article never specifies the accountability mechanism when multiple orchestrators, or an orchestrator and a vendor/platform, jointly produce a system that fails — it only asserts that delegated intelligence is 'always traceable back to an accountable operator' without addressing shared or contested authorship, which is the common real-world case (an orchestrator directing a third-party agent platform built by another company).What's an Orchestrator—and Why Does Software Need One? — read next: Multi-party AI liability and supply-chain accountability frameworks (e.g. the enterprise-as-accountable-integrator argument in extract-outsourced-ai-still-own-the-risk); agent identity/attribution mechanisms that bind actions to a specific accountable principal.
- incompleteThe 'agent-compatible commercial authorization' prescription addresses verifying an agent's authority to transact (authentication/authorization) but says nothing about liability or recourse when a duly-authorized agent negotiates a bad deal, misreads a term, or commits a company to an unfavorable contract at machine speed. Verified authority to act and good judgment in acting are conflated.When Your Buyer Is an AI Agent — read next: Look for enterprise governance/liability frameworks specifically for autonomous-agent-negotiated contracts, distinct from the identity/authentication layer (Descope, Entro Labs) the article cites.
- illogicalThe piece claims TPM agents are 'low risk' specifically 'because they cannot act,' while in the same breath describing agents with external email and Slack access that communicate directly with accountants, lawyers, and other outside parties on the author's behalf — autonomously sending external communications is itself a consequential action (reputational, legal, social-engineering-surface risk), which the stated risk framing doesn't account for.Hear me out: Agentic TPMs (Technical Program Managers) — read next: Corpus material on agent identity/attribution and on the lethal-trifecta pattern (private data + untrusted content + external action) for a more rigorous risk model that would classify unsupervised external messaging as action, not passive observation.