Build agent auth that survives incidents: scoped identities, short-lived tokens, and revocable delegation

The identity gap

An agent writes to a production table. The incident review asks who did it. The log says a person. That person was asleep. The answer is not better monitoring. It is agent authentication architecture.

Traditional identity and access management assumes the authenticated principal is a person, an assumption that does not fit AI agents.

Agents reusing human logins corrupt audit trails by attributing agent actions to the human whose credentials are used, producing a misleading record. The human becomes a proxy for machine behavior. The agent becomes invisible.

Agent identity is typically asserted by infrastructure such as IAM roles or workload tokens rather than by interactive human authentication, so the surrounding infrastructure identifies the agent.

Build the reference model

Start with a reference model. The principal is the agent, not the user. The credential is workload-issued, task-scoped, and short-lived. Delegation is a signed chain. Audit records actor, parent, task, scope, and expiry. Revocation is an identity-level kill switch.

Scoped agent credentials should be obtained through token exchange so each task receives a narrower, shorter-lived token, not a broader or longer-lived one.

If a human approves a task, the approval must appear in the chain.

Fixed token lifetimes alone leave a gap between issuance and expiry, which can limit timely revocation or reaction to abnormal agent behavior.

Operate the kill switch

Build the incident path before you need it. The goal is not to catch every bad action after the fact. The goal is to stop the agent while the blast radius is still small.

Use identity-level revocation. Revoke the agent, not just the current token. Revoke the delegation, not just the task. Revoke the scope, not just the endpoint. If the agent is compromised, every credential it can mint should stop working.

Make the audit record answer four questions: who acted, who delegated, what task was being performed, and what scope was granted. If the record cannot answer those questions, the incident review will fill the gaps with blame.

Separate the human from the machine in every log line. A human may request work. A human may approve a high-risk action. A human may set policy. But the agent is the actor. The log should show the agent as the actor, the human as the requester or approver, and the platform as the issuer.

Keep the default deny. An agent should not inherit broad access because it is running in a trusted namespace. It should not inherit access because another agent asked for it. It should not inherit access because a previous task used it. Access should be granted for the current task, for the current scope, and for the current chain. When the task ends, the access ends.

Ship a checklist into the agent runtime:

• Every agent has a distinct identity.
• Every credential is scoped to one task or one bounded job.
• Every token exchange records the parent credential and the child scope.
• Every delegation step is signed or otherwise attributable.
• Every revocation action targets the agent identity and propagates to all active credentials.
• Every audit event includes actor, parent, task, scope, and expiry.

Then test the failure modes. Stop the agent while it is running. Stop it after it delegates. Stop it after it exchanges a token. Stop it after it writes to a system that should not be touched. If the platform cannot do all four, the architecture is not ready for production access.

End with the rule that should drive the design: an agent is not a person, and it should not be treated like one. Give it a machine identity. Give it a narrow credential. Give it a visible chain. Give it a kill switch. Then the incident review has a real answer.