Agent Identity

Agent identity means an AI agent authenticates as itself — its own principal, its own scoped credential, its own audit trail — rather than reusing the credentials of the person who started it. Every action it takes is attributable to that agent, and its permissions are the ones the agent needs rather than the ones its operator happens to have.

The default today is the opposite. An agent runs with a developer's Git token, their cloud profile and their shell. It can do everything they can do, and in the audit log it *is* them: there is no way, after the fact, to distinguish an action the person took from one the model decided to take.

Borrowed credentials break accountability, which is the property every other control depends on. If the log cannot separate the human from the agent, then incident review, access review and compliance evidence are all built on an ambiguity.

They also break least privilege in the most expensive direction. An agent inherits its operator's full permission set, which for an engineer is usually broad. A prompt injection or a poisoned tool description then executes against all of it — the injection did not need to escalate, because the privilege was already there.

And revocation becomes coupled to people. When the only way to stop a misbehaving agent is to disable the account it borrowed, the response to an agent incident is to lock out an employee.