Persistent AI Coworkers Need Their Own Identities and Access Controls
Summary
The article warns that persistent AI agents using human credentials can accumulate excessive access and obscure audit trails. It recommends giving each agent its own identity, owner, scoped access, and defined expiration conditions.
Key points
- Persistent agents may retain standing privileges, accumulate access across projects, and combine permissions beyond what was intended.
- When agents act using a person’s credentials, audit logs can attribute their actions to that human rather than the agent.
- The article says current hosted agent platforms generally do not provide agents with their own credentials; static bearer tokens are not a proper identity model.
- Recommended controls include discovering unregistered agents through authentication traffic and assigning each persistent agent a distinct identity and human owner.
- Scope permissions to the agent’s tasks, and define revocation or expiration conditions for events such as an owner leaving or prolonged inactivity.
- The article notes that some identity vendors offer agent identity features, but those controls are limited to their own platforms.
Article Details
- Defense Focus
- Govern persistent AI agents as distinct identities rather than allowing them to act with borrowed human credentials, and detect unregistered agents through authentication activity.
- Detection Methods
- Identify unregistered agents by analyzing authentication traffic.
- Look for OAuth grants, API keys, and login traffic associated with AI agents and MCP servers.
- Data Sources
- Authentication traffic
- OAuth grants
- API keys
- Login traffic
- Platforms
- Entra Agent ID
- Okta Universal Directory
- Defensive Actions
- Assign each persistent agent its own identity and record a human owner.
- Scope access to the agent's tasks rather than inheriting the initiating user's permissions.
- Set lifecycle and deprovisioning conditions, including owner departure and inactivity-based expiration.
- Use scoped, rotated credentials and provide a revocation path.
- Review agents that authenticate as humans because their actions may be misattributed in audit trails.
People
Vendors
CyberArkSailPoint and CyberArk have comparable offerings.MicrosoftMicrosoft talks about agents as "digital colleagues," and OpenAI's Sam Altman outlined the plan for virtual co-workers what seems like a lifetime ago, in February 2025.OktaOkta added agent identities to Universal Directory, with short-lived, scoped tokens and a revocation path.SailPointSailPoint and CyberArk have comparable offerings.Token SecuritySponsored by Token Security
Products
ChatGPT WorkTara Seshan, who leads product for ChatGPT Work and Codex at OpenAI, described what actually makes an agent useful on Lenny's Podcast in August 2026.CodexTara Seshan, who leads product for ChatGPT Work and Codex at OpenAI, described what actually makes an agent useful on Lenny's Podcast in August 2026.Entra Agent IDMicrosoft shipped Entra Agent ID with first-class agent identities and a named human sponsor.Universal DirectoryOkta added agent identities to Universal Directory, with short-lived, scoped tokens and a revocation path.