Roy Katmor Outlines Five Checks for Securing AI Agent Credentials
Summary
Roy Katmor recommends tracking each AI agent’s owner, tools, credentials, authority, and behavior, then comparing intended with observed activity and applying scoped controls, including a targeted kill switch.
Key points
- AI agents may be approved while the identities and credentials they use go unreviewed.
- An example onboarding agent connects to HR, identity, ticketing, payroll, and internal applications.
- Agents may use OAuth tokens, API keys, service accounts, or borrowed human accounts.
- Accumulated permissions can give an account more authority than the agent’s original task requires.
- Katmor recommends inventorying each agent’s owner and purpose, accessible tools, credentials, effective authority, and runtime behavior.
- Organizations can compare approved intent with observed behavior and apply scoped controls, including a targeted kill switch.
Article Details
- Defense Focus
- Inventory AI agents and their credentials, permissions, and runtime behavior; constrain access to approved purposes and provide a targeted kill switch.
- Detection Methods
- Compare each agent’s approved intent with its observed runtime behavior.
- Review agent ownership, purpose, connected tools, credentials, and effective authority.
- Data Sources
- Agent inventories and ownership records
- OAuth tokens, API keys, service accounts, and borrowed human accounts
- Agent runtime behavior and activity
- Connected HR, identity provider, ticketing, payroll, and internal application access
- Defensive Actions
- Track each AI agent like an application, recording its owner, purpose, reachable tools, credentials, effective authority, and runtime behavior.
- Review credentials and accumulated permissions; scope access to the agent’s intended job.
- Compare approved intent with observed behavior and use a targeted kill switch to disable an agent when needed.