Say whether each agent acts under its own identity or borrows a human's, who owns that identity, what it may do and how it is revoked. Agents that borrow a person's credentials make audit and revocation hard, so if that is your setup, state the compensating controls.
What the question is really about
A reviewer wants to answer "who did this?" after an incident. If an agent uses a developer's personal token, the log says the developer did it. If the agent has its own identity, the log says an agent did it on behalf of a named user. The second is far easier to investigate and to shut off.
Three common setups
| Setup | Audit clarity | Revocation | Risk |
|---|---|---|---|
| Agent uses the human's credentials | Poor | Revoking breaks the human too | High |
| Shared service account for all agents | Medium | Revokes everyone at once | Medium to high |
| Distinct identity per agent, tied to a user | Good | Targeted | Lower |
Most teams start in row one or two. Saying so honestly, with a migration plan, is fine.
The five facts to include
- Identity type. Per agent, per user, or shared.
- Owner. A named person or team accountable for each agent.
- Scope. What the identity may call, written as a matrix.
- Lifetime. Short lived credentials, or long lived keys with rotation.
- Revocation. How quickly it can be turned off without affecting people.
Note the link with scope design. The MCP security guidance warns against broad scopes and wildcard permissions granted up front. An agent identity with minimal scopes limits what a leaked or abused credential can do.
Delegation and the confused deputy
When an agent acts for a user, the system should still check what that user may do. The specification discusses the confused deputy problem for MCP proxy servers, where static client IDs and consent cookies let a malicious client obtain authorization without the user's consent. Mention that your proxy or gateway asks for consent per client, if you run one. See the confused deputy and per client consent.
Sample wording
"Each production agent runs under its own identity registered in our inventory, with a named owner and a permission matrix. Credentials are short lived and the identity can be revoked without affecting any user. Logs record both the agent and the user it acts for. Two experimental agents still use shared accounts and will move to individual identities by a stated date."
Evidence
The agent register, a permission matrix and a revocation record from a test. Safeguard's agent identity capability is designed for this: it gives agents distinct, manageable identities, and the MCP Guardrail controls the tools they can call.
Quick check
Is a service account an agent identity?
A dedicated account per agent is. One account shared by many agents hides which one acted and can only be revoked as a group.
Should the agent inherit the user's permissions?
Usually the agent should have a subset. Giving it everything the user can do turns every injected instruction into a user level action.
Sources
Last reviewed: 19 October 2026.
