Agent identity means giving each AI agent its own verifiable identity, with a named owner, limited permissions and a record of its actions. It replaces the habit of agents borrowing a person's token or sharing a service account, which makes actions untraceable and revocation blunt.
Why does it matter now?
AI agents no longer just answer questions. They open pull requests, query databases, call APIs and trigger workflows. Every one of those actions happens under some identity. If that identity is a developer's personal token, then logs blame the developer, permissions match the developer's reach, and revoking the agent means locking out the person.
OWASP's LLM Top 10 includes Excessive Agency, the case where a system is given more capability than its task needs. Its Top 10 for Agentic Applications for 2026, developed with more than 100 contributors according to OWASP, addresses risks in systems that plan and act. Identity is one of the ways to hold agency in check, because access follows the identity.
What are the parts?
Identity. A unique identifier for the agent, issued by something you control. It is not the model name, and it is not a shared key. Standards for workload identity, such as SPIFFE, show the idea for services: a verifiable identity for each workload.
Owner. A named human or team accountable for the agent. When the owner leaves, the agent's access should be reviewed.
Permissions. What the agent may read, change or call, kept to the minimum the task needs. The MCP security guidance describes starting with a minimal scope set and elevating when needed, since a broad token increases the damage of a leak.
Delegation. Often an agent acts for a person. OAuth token exchange, defined in RFC 8693, covers delegation, where one party acts on behalf of another and the token records both, and impersonation, where one party fully assumes another's identity. Delegation keeps attribution. Impersonation loses it.
Records. For each action: which agent, on whose behalf, with which permission, when, and the result.
Lifecycle. Creation, change, review and removal. Agents that were meant to be temporary tend to live forever unless something expires them.
How is it different from a service account?
A service account is an identity for software, and an agent can have one. The difference is behavior. A service account runs fixed code with a predictable set of calls. An agent chooses its calls at run time, so a permission set that is fine for a script may be too wide for an agent. Agent identity adds ownership, narrower scopes, short lifetimes and per action records suited to that unpredictability.
How is it different from a human identity?
Humans authenticate interactively and can be asked to confirm. Agents run unattended, in parallel and at speed. They can spawn sub agents, and you must decide whether a child inherits its parent's access. Human controls such as multi factor prompts do not map well, so approvals for risky actions need design.
What goes wrong without it?
A shared token leaks and every agent is compromised. An agent does something odd and nobody can tell which one, or for whom. A contractor's agent keeps access after the contract ends. An audit asks what an agent was allowed to do and the answer is "whatever Sam could do".
What does it not solve?
Identity does not stop a manipulated agent from using access it legitimately has. That is why scopes and guardrails on actions matter alongside it. Nor does it judge whether an agent's output is correct.
Where Safeguard fits
Safeguard's agent identity tracks which agent holds what access at what level. MCP Guardrail, a proxy for MCP servers, checks agent calls against policy, and gates enforce rules at build, CI and release. Together they cover who the agent is, what it may do and what it did.
What to do
- Inventory the agents running in your organization and the credentials they use.
- Replace shared and personal tokens with per agent identities.
- Name an owner for each agent.
- Reduce scopes to the minimum and prefer short lived credentials.
- Record agent, delegator, action and result.
- Review and expire identities on a schedule.
Quick check
Is agent identity the same as a service account?
Not quite. A service account is one possible carrier. Agent identity adds an owner, narrow scopes, short lifetimes and action records suited to an agent that decides its own calls.
What is the difference between delegation and impersonation?
Delegation records that an agent acts on behalf of someone. Impersonation makes the agent appear to be that person, which loses attribution.
Sources
- OWASP Top 10 for LLM Applications
- OWASP Top 10 for Agentic Applications for 2026
- MCP security guidance
- RFC 8693, OAuth 2.0 Token Exchange
- SPIFFE concepts
Last reviewed: 18 October 2026.
