There is one question that separates teams running agents securely from teams merely running agents: when the agent is executing nothing, what can its credential still do?
In most deployments the answer is “everything”. That is an identity problem the security industry already solved for humans — and is about to have to solve again, from scratch, for software.
What PAM taught us
Modern privileged access management rests on a simple idea: standing privilege is standing risk. So we built JIT — access granted at the moment of need, scoped, auto-expiring, fully audited. An administrator does not carry admin power all day; they request it, use it, and give it back.
Now look at how we typically grant access to an agent. We create a service account. We attach the permissions it might need — and when unsure, a few more. We generate a key. We put the key in an environment variable. And we leave it there.
That credential does not expire when the task finishes. It is not reduced while the agent is idle. It does not distinguish “this agent is reading a report” from “this agent is dropping a table”. It is standing privilege — exactly what we spent a decade removing from the human side.
Why it is worse than the human case
- Injection surface. A human with standing privilege can be phished. An agent with standing privilege can be instructed by any text that enters its context — a repository issue, the contents of a web page, a tool description.
- Speed. A compromised human acts in minutes. An agent acts in milliseconds, in a loop, without hesitating at a strange instruction.
- Attribution. When five agents share one service account, the log says “the automation account” did it. That is useless in an investigation.
What the correct design looks like
The good news is that we do not need new primitives. We need to apply the ones we have:
- One identity per agent, not one identity per fleet. Without this, nothing else is auditable.
- Workload identity federation instead of long-lived keys. If no static key exists, no static key leaks.
- Per-task JIT elevation. The agent starts read-only and requests write access for a specific operation, with a short TTL.
- Human approval on irreversible actions. Delete, transfer, publish, grant. The list is short and you can write it in an afternoon.
- Audit at the tool-call level, correlated to agent identity and to the task that triggered it.
The test I would run
Take any agent running in production at your company and answer three questions: which identity does it use, how long does its credential live, and what can that credential do on a Tuesday at three in the morning with nobody watching.
If those three answers do not come quickly, the agent is not governed. It is merely working — which is a very different thing.
