Agent Identity

What is Agent Identity?

Agent identity means treating an AI agent as a principal in its own right, with a named identity in the company's identity provider, instead of letting it borrow a person's login or a shared service account. Every call the agent makes can then be tied to that agent, checked against what it is allowed to do, and recorded.

Most companies don't work this way yet. Coding agents run with the developer's credentials, background jobs run as a user or an anonymous system role, and chat assistants inherit user permissions. When something goes wrong, the log shows that a key was used but not which agent used it, who was driving it, or who approved its access.

Key Characteristics

• The agent is its own principal - It has an identity from the same identity provider as human users, so policies and deprovisioning apply consistently.
• Operator and authorizer are recorded separately - The person driving the agent in real time is logged for attribution, and the person who approved its credential is fixed for that credential's lifetime.
• Permissions are an intersection - In Speakeasy's model, an action must fall within the credential's ceiling, the agent's own policy (which can't hold admin or human-only scopes) and the owner's current policy. An agent can never do more than the person accountable for it.
• Evaluated on every call - Policies are re-read per request, so a revoked permission or a departing owner takes effect on the next call.
• Decisions are recorded before execution - Each allow, deny, modify, quarantine or escalate decision is logged along with the agent's stated intent.

Why Agent Identity Matters

In regulated industries, auditors ask who acted, who allowed it, and where the record is. Without agent identity, none of those questions can be answered. It also contains damage: an agent scoped to staging can't touch production even if it finds a production key, because the key alone no longer grants the action.

Historical Context

The idea extends established practice for human users (sign in as yourself, don't share keys, don't approve your own escalation) and for non-human service identities. It became pressing in 2025 and 2026 as coding agents and MCP-connected assistants began acting with real credentials, and incidents like an agent deleting a startup's production database showed what happens when valid keys meet no policy.

Related Reading

• Speakeasy's Sagar Batchu: Valid Keys Aren't Valid Intent - The incident and the identity model
• Agent Registry - Knowing which agents exist and who owns them
• Human-in-the-Loop - Where escalations go