A two week agent identity trial should answer one question: can you tell which agent did what, limit what it can reach, and cut it off without breaking the others? Pick three real agents, give each its own identity, and test revocation, scope and audit records.
What are you testing?
Agent identity gives each AI agent its own verifiable identity, with an owner, a set of permissions and a trail of actions. Today many agents run on a developer's personal token or a shared service account, which means logs say "Sam did this" when Sam did not. The trial checks whether a product, or your own design, fixes that.
Before day one
Pick three agents of different shapes: one that reads (a summarizer over tickets), one that writes (a coding agent that opens pull requests), and one that calls external tools over MCP. Different shapes expose different gaps.
Write the pass criteria. For example: each agent has a unique identity; each action in the test is attributed to the right agent; revoking one agent takes effect within a time you set and does not affect the others; no agent holds access it did not need.
Name an owner for each agent. An identity with no owner is a finding on its own.
Days 1 to 3: discover what exists
List what each agent holds today: tokens, keys, cloud roles, repository permissions. This inventory is often the most valuable output of the whole trial. Note which credentials are personal, which are shared, and which never expire.
Days 4 to 6: issue and scope
Create identities for the three agents and grant the narrowest access that lets each do its job. The MCP security guidance describes starting from a minimal scope set and elevating on demand, because broad tokens widen the damage of a leak. Try that pattern. Start each agent with less than it seems to need and add access as failures show real needs.
Check the credential type. Short lived tokens beat long lived keys. Where a downstream system only accepts a key, record it as a gap.
Days 7 to 9: attribution test
Run a script of actions for each agent: read a record, change a file, call a tool. Then answer from the logs alone: which agent, acting for whom, with what permission, at what time? OAuth token exchange (RFC 8693) describes an actor claim for recording that one party acts on behalf of another. You do not need that exact mechanism, but you do need the same answer.
Include one action that should fail. An agent trying to delete a repository, or reach a system outside its scope, should be denied and the denial recorded.
Days 10 to 11: revocation drill
Revoke one agent mid task. Measure how long it keeps working and what it does when it fails. Confirm the others continue. Then revoke a credential that was shared, and see how many agents it takes out. That number is your blast radius today.
Days 12 to 13: failure and humans
Test the awkward cases. What happens when an agent spawns a sub agent? Does the child inherit the parent's access, and should it? What happens when an identity's owner leaves? Is there an approval step for high risk actions, and can someone actually be reached to approve?
Day 14: decide
Compare results with your criteria. Record effort: hours to onboard each agent, systems that needed workarounds, and logging gaps. Include data questions: where are audit records stored, for how long, and can you export them?
A pass is not "the demo worked". A pass is "three real agents, unique identities, correct attribution, revocation that works".
What a trial cannot show
Two weeks will not test scale, long term rotation or how the product handles agent frameworks you adopt next quarter. Ask for references and the product's supported integrations in writing.
Where Safeguard fits
Safeguard's agent identity tracks which agent holds what access at what level. It works alongside MCP Guardrail, a proxy that checks MCP calls against policy, and with gates at build and release. Treat any trial of it like the plan above and hold it to the same criteria.
What to do
- Pick three agents: one reads, one writes, one calls MCP tools.
- Name an owner for each and set pass criteria.
- Inventory the credentials each agent holds today.
- Issue unique identities with minimal scope.
- Verify attribution and a denied action from the logs alone.
- Drill revocation on one agent and on a shared credential.
- Record effort, gaps and data export terms.
Quick check
How many agents should a trial include?
Three of different shapes is enough: one that reads, one that writes and one that calls external tools.
What is the most telling test?
Revoking a single agent mid task and confirming that only that agent stops, with the action recorded.
Sources
- MCP security guidance
- RFC 8693, OAuth 2.0 Token Exchange
- OWASP Top 10 for Agentic Applications for 2026
Last reviewed: 18 October 2026.
