Agent credentials: issue, scope, expire and revoke

Treat an agent credential like any high value machine credential: issue it to a single agent identity, scope it to the task, make it expire quickly, log its use and rehearse revoking it. The worst pattern is an agent running on a developer's long lived personal token, because nobody can tell who did what or shut it off cleanly.

Issue

Give every agent its own identity. Shared accounts hide which agent acted, and personal logins tie the agent's life to a person's employment. Record the owner, purpose and environment at issue time.

Prefer a flow where the agent gets a token on demand, rather than a stored secret baked into config. If you must store a secret, keep it in a secrets manager, never in the prompt, repository or agent memory. Our post on what never belongs in a system prompt covers the prompt side.

Scope

Scope is where most damage is decided. Questions to ask:

• Which systems does the task really touch?
• Does it need read, write or both?
• Can the token be limited to one project, folder, table or tenant?
• Can the scope narrow further per task rather than per agent?

If a user's identity is delegated, the agent should hold no more than the user would, and often less. The difference between delegation and impersonation matters; see delegation vs impersonation.

Expire

Short lifetimes limit how long a stolen token is useful. Hours or minutes suit most agent tasks. Combine with refresh rules you can revoke, and avoid tokens that never expire.

Do not forget the ones you cannot rotate easily: API keys in third party tools. Put those on a calendar and give each an owner.

Monitor

Log each use with agent identity, target, action and time. Alert on:

• use from an unexpected network or at an unusual hour
• a sudden jump in volume
• access to resources outside the agent's normal pattern
• failed attempts, which can indicate probing

Revoke

Practice it. A revoke runbook should answer:

1. Who can pull the plug, and how fast?
2. What does revoking one agent break?
3. How do you find every token that agent held, including those in connected tools?
4. How do you rotate anything the agent could have read?

Run a drill each quarter for your highest risk agent. If it takes an afternoon to find the tokens, you have found a gap before an attacker did.

Offboarding agents

Agents should be retired like people. When a project ends, remove the identity, the tokens and the connectors, and archive the logs.

Where Safeguard fits

Safeguard's agent identity gives each agent a scoped identity of its own, and policies and guardrails limit what it can call. Asset discovery helps you find agents and connectors you forgot.

Quick check

Last reviewed: 19 October 2026.