Agent identity means giving every AI agent its own identity, with its own credentials and permissions, so you can see what each one can reach and revoke it alone. Before buying, ask how the product issues, scopes, logs and retires agent access. These twelve questions expose weak answers fast.
Why ask at all?
AI agents call tools, read data and sometimes write to production. OWASP lists Excessive Agency in its Top 10 for LLM applications, describing systems given more autonomy or permissions than they need. If agents share a human's login or one long-lived service key, you cannot tell who did what, and you cannot narrow access without breaking everything.
Credentials
- How does each agent get its own identity? Ask to see a new agent being created and what it holds afterward. If the answer is "a shared API key per team," that is not agent identity.
- How long do credentials live, and how do they rotate? Short-lived tokens beat static secrets. Ask what happens to a running agent when its token expires.
- Where do secrets sit at runtime? Ask whether the agent process ever sees a long-term secret, or only a scoped, short-lived credential issued on demand.
Scope and permissions
- How granular is a grant? Can you permit one tool on one server for one purpose, or only broad roles? Ask for a sample policy and read it.
- Can access depend on context, such as the task, the human who started the run, or the environment? An agent working a support ticket should not carry the same rights as one running a deploy.
- Can you see effective access? You want a view that answers "what can this agent reach right now" including inherited and delegated rights. A list of assigned roles is not the same thing.
- How are agents acting on behalf of a user handled? Ask whether the agent's rights are the intersection of its own and the user's, or the union. The union is a privilege escalation path.
Visibility and evidence
- What do logs record? At minimum: agent identity, tool called, target, decision and time. Ask whether arguments are logged or redacted and who can read them.
- Can logs be exported to your own store in a documented format? If evidence lives only inside the vendor, an audit or incident becomes a support ticket.
- Does it show shadow agents? Discovery of agents nobody registered matters more than managing the registered ones.
Control and exit
- What is the kill switch? Ask how fast one agent can be disabled, whether that cuts active sessions, and whether it works when the vendor console is down.
- What happens at exit? Ask what you can take with you: inventory, policies, logs. Ask how identities are removed from your systems, not just from the vendor view.
How should you test the answers?
Run a short proof of concept with three agents of different risk: a read-only one, one that writes to a ticketing system, and one that can touch a test deploy pipeline. Try to make each exceed its scope. Revoke one mid-task. Export the logs and check that they answer "who did what" without help from the vendor.
Do not accept slideware for questions 6, 8 and 11. Those three are where products differ most.
Where Safeguard fits
Safeguard offers agent identity as a generally available capability: it tracks which agent holds what access at what level, alongside the MCP Guardrail proxy for MCP servers and policy enforcement at build and release. Compare it using the same twelve questions, as you would any vendor. This guide ranks no products and Safeguard does not claim to replace your identity provider.
What red flags should end the conversation?
Three answers should slow you down. First, "the agent uses the user's token" with no separate record of the agent: you lose accountability. Second, logs that cannot be exported or that omit the target of each call: you lose evidence. Third, no way to show effective access: you cannot answer a basic audit question. A vendor can recover from a gap on a roadmap, but only if it says so plainly. Reward vendors who tell you what their product cannot do yet, and write those answers into the contract schedule so you can hold them to dates.
What to do
- Inventory your agents today, including coding assistants and automation with API keys.
- Pick the five questions that matter most for your risk and weight them.
- Send all twelve in writing and keep the answers.
- Run the three agent test above.
- Check the contract for log export, data deletion and notice of changes.
- Review agent grants quarterly after you sign.
Quick check
Is a shared service account acceptable for agents?
It is a weak default. One shared account hides which agent acted and forces all or nothing revocation. Give each agent its own identity and narrow scope.
What is the single most revealing question?
Ask for a live demo of revoking one agent mid task and reading the resulting log. It tests identity, control and evidence in one go.
Sources
Last reviewed: 18 October 2026.
