Useful agent identity metrics show who owns each agent, how much access it holds, how old its credentials are and how fast you can switch it off. Misleading ones count volume, such as agents registered or tokens issued, which rise with growth and say nothing about control.
What is an agent identity metric for?
It should answer one question: can we explain and limit what each agent can do? OWASP's Non-Human Identities Top 10 lists improper offboarding, secret leakage, overprivileged identities, long lived secrets and identity reuse among top risks. OWASP's guidance on Excessive Agency adds excessive functionality, excessive permissions and excessive autonomy as root causes of agent harm. Good metrics map to those risks directly.
Metrics that matter
Owner coverage. Share of agents with a named, current human owner. Check that owners still work in the company. A stale owner is the same as none.
Inventory confidence. Share of agents found by at least two independent sources, such as repositories, platform admin pages and credential stores. An agent seen in one place only is a sign your list may be incomplete.
Write and delete access. Number and share of agents that can change or remove data, and the share of those with a reviewed, documented reason. This is the number that matters most when something goes wrong.
Credential age. Median and maximum age of credentials held by agents, and the share that never expire. OWASP names long lived secrets as a top risk.
Credential sharing. Count of credentials used by more than one agent, or by an agent and a human. OWASP lists both identity reuse and human use of machine identities as risks.
Time to disable. From decision to the moment an agent can no longer act: credential revoked, tools disabled, workflow paused. Test it in exercises and report the median and the worst result.
Approval rate for high impact actions. Of the actions that need human approval, how many were approved, declined or timed out. A rate of 100 percent approved with no review time suggests rubber stamping.
Orphan rate. Agents whose owner left or whose purpose is gone, and the days it took to retire them. Offboarding is OWASP's first listed risk.
Metrics that mislead
Total agents. Goes up as the business adopts AI. Growth is not control. Report it only with the owner coverage next to it.
Tokens or keys issued. Measures issuance, not safety. A team issuing short lived tokens will look busier than one with a single permanent key.
Number of policies. A hundred policies can protect less than five good ones. Measure what they block and what they allow, not how many exist.
Percent of agents "onboarded". Depends on how you define onboarded. If it means "registered", you have measured paperwork.
Zero access violations. May mean good controls, or no logging. Pair with tests that deliberately attempt a violation in a safe environment.
Average permissions per agent. Averages hide the one agent with broad access. Look at the maximum and the top ten.
How should you present them?
Give leadership five numbers with trend lines and the denominator: owner coverage, inventory confidence, agents with write or delete access, credential age (median and longest), and time to disable. Everything else is for the operating team.
How do you stop gaming?
If you target owner coverage, people may assign owners without telling them. Pair it with a quarterly owner confirmation, where each owner acknowledges the list of agents they hold. If you target credential age, teams may rotate on a schedule but keep the same broad scope. Pair age with permission scope.
Where do vulnerability and supply chain data help?
Add a metric: the share of agents whose component list is known and checked for flaws. It connects identity to the vulnerability program, and lets you say which agents are affected when an advisory lands.
What to do
- Choose the five headline metrics and define each one.
- Record sources for the inventory and compare them monthly.
- Run a quarterly exercise that disables one agent and times it.
- Pair every metric with a second one that stops gaming.
- Ask owners to confirm their agents each quarter.
- Retire total agents and tokens issued from leadership reports.
Where Safeguard fits
Safeguard's agent identity capability tracks which agents hold what access at what level, which supplies the data behind owner coverage, write access counts and scope. Its guardrails and policies can enforce limits at build, CI and release, so time to disable and approval rules can be tested. Safeguard works on the application and delivery side and does not replace your identity provider.
Quick check
Is the number of registered agents a good metric?
Not on its own. It grows with adoption. Report it alongside owner coverage and the number of agents with write or delete access.
What is the most telling agent identity number?
The share of agents with write or delete access that have a named owner and a reviewed reason. It shows where the real risk sits and who answers for it.
Sources
- OWASP Non-Human Identities Top 10
- OWASP LLM Top 10, Excessive Agency
- OWASP Top 10 for Agentic Applications for 2026
Last reviewed: 18 October 2026.
