A small team can get AI agents under identity control in 90 days. Month one: find and list every agent. Month two: give each its own identity and narrow, expiring access. Month three: log actions to that identity, test revocation and set a monthly review. Skip fancy tooling until these basics work.
Month one: find every agent
You cannot control what you have not counted. Spend the first weeks building a register.
Where to look. Coding assistants and agents in IDEs, CI jobs that call models, chat bots with tool access, scripts with API keys for AI services, workflow tools, and any MCP clients and servers in use. Ask each engineer for a list, then check against secret stores and API gateway logs for credentials you did not know about.
What to record per agent.
| Field | Example |
|---|---|
| Name and purpose | Release notes drafter |
| Owner | A named person |
| Credential in use | Personal token, shared key, own identity |
| Systems it can reach | Code host, ticket tool |
| Access level | Read only, write, admin |
| Last used | Date |
By the end of month one you should have an honest list, often longer than anyone guessed, and a mark against every agent that uses a personal or shared credential.
Month two: separate and narrow
Take the register and fix the worst entries first: admin access, personal tokens, shared keys.
Give each agent its own identity. Where agents act for a user, use delegation rather than the user's own credential. RFC 8693 describes token exchange in OAuth, including delegation. For workloads, the SPIFFE standards describe a way to identify software securely. You need not adopt them wholesale, but they show the pattern: a distinct, verifiable identity per workload.
Narrow the access. For each agent, ask what the smallest permission is that still lets it do its job. Remove the rest. OWASP's 2025 list for LLM applications names Excessive Agency as a risk, which is the problem you are fixing.
Add expiry. Prefer short lived credentials. Where a long lived key is unavoidable, give it an owner and a rotation date.
Review tool servers. If agents connect through MCP, the authorization specification builds on OAuth for HTTP servers. Check what credentials those servers hold, since they extend the chain of access.
Month three: log, test, repeat
Log with identity. Each action should record agent identity, acting user if any, tool, target and result. Test by asking, "What did agent X do last Tuesday?" If it takes hours, improve the logs.
Test revocation. Pick one agent and revoke its access. Check that it stops, that nothing else breaks and that you can restore it with approval. Time it.
Add one approval gate. For the most sensitive action an agent can take, such as deploying or deleting, require human approval. Keep the list short.
Start the review habit. A monthly 30 minute meeting: new agents, expired credentials, access changes, and anything unused for 30 days gets retired.
How do you know it is working?
| Measure | Direction |
|---|---|
| Agents with own identity, as a share of all | Up |
| Agents with admin or shared credentials | Down to zero |
| Credentials with expiry | Up |
| Time to answer "what did X do" | Down |
| Time to revoke one agent | Down |
What can wait?
A full workload identity platform, automated access reviews and anomaly detection can come after the basics. A spreadsheet and disciplined habits beat unused tooling.
Where Safeguard fits
Safeguard supports agent identity, tracking which agent holds what access at what level, an MCP Guardrail that sits in front of MCP servers, and policies and gates enforced at build, CI and release. Those cover the register, the access limits and enforcement points in the plan above.
What to do
- List every agent with owner, credential, reach and access level.
- Retire personal and shared credentials first.
- Give each agent its own identity with the narrowest access.
- Set expiry or rotation on every credential.
- Log actions with identity and test the log with a real question.
- Hold a monthly review and retire unused agents.
Quick check
What is the first step?
Build the register. Counting every agent, owner and credential shows where the largest risks are and what to fix first.
Do I need special software to start?
No. A shared sheet, per agent credentials and a monthly review get you most of the benefit. Tooling helps once the habits exist.
Sources
- RFC 8693, OAuth 2.0 Token Exchange
- SPIFFE overview
- Model Context Protocol authorization specification
- OWASP Top 10 for LLM Applications, 2025
Last reviewed: 18 October 2026.
