Secure an AI agent as a distinct non-human identity with a named owner, narrow permissions, short-lived credentials, approval gates and an audit trail that preserves both the agent and any person it represents. Review access on a schedule and revoke it when the workflow, owner or risk changes.
Why an AI agent needs its own identity
An agent can read data, choose tools and act across several systems. A shared employee or administrator account hides which actions came from the agent and usually grants more access than the task requires. A distinct identity makes ownership, permissions and activity reviewable.
Microsoft describes agent identities as a way to uniquely identify and authenticate agents, distinguish their operations from human and workload identities, and apply right-sized access. In Microsoft Entra, an agent identity is a specialized service principal; delegated designs can preserve the user as the subject and the agent as the actor. (Microsoft Entra agent identities, checked October 15, 2026.)
The 10-point checklist
1. Inventory the agent and assign an owner
Record the agent's purpose, business owner, technical owner, operating organization and branch, environments, connected systems, data classes and expected lifetime. An unowned agent should not reach production.
2. Give the agent a distinct identity
Use a workload or agent identity issued by the organization's identity platform. Do not embed a person's password, reuse an administrator account or identify every agent as the same generic service account.
3. Choose delegated or autonomous access explicitly
Delegated access is appropriate when an agent acts for a signed-in person and must stay within that person's context. Autonomous access is appropriate for scheduled or background work with its own approved permissions. Preserve both actor and subject when the agent represents a person.
| Identity pattern | Appropriate use | Minimum audit evidence |
|---|---|---|
| Delegated agent | A person asks the agent to perform a bounded action | User, agent, consent, resource, action and result |
| Autonomous agent | Scheduled or event-driven work with no active user | Agent, owner, trigger, resource, action and result |
| Agent user account | Compatibility with a system that requires a user-shaped account | Agent identity, paired account, owner, role and session |
4. Map resources and actions before assigning roles
List each API, MCP server, database, file store and business application. For each one, define allowed read, create, update, delete and administrative actions. Scope data by organization, branch and role so one client, franchisee or branch cannot inherit another's access.
5. Apply least privilege to every request
Default to read-only, then grant individual write actions only where the workflow needs them. NIST Zero Trust guidance says trust should not be implied by network location or asset ownership; authenticate and authorize before access and limit access to what is required. (NIST SP 800-207, checked October 15, 2026.)
6. Prefer short-lived and federated credentials
Use managed identity, workload federation or short-lived OAuth tokens where the platform supports them. Keep secrets in an approved vault, rotate them, restrict their audience and never place them in prompts, source code or agent memory.
7. Require human approval for consequential tools
Put an approval gate before payments, refunds, access grants, deletions, legal or employment decisions and external messages with material consequences. ServiceNow separates who may invoke an agent from the identity the agent uses to run, and supports supervised execution for critical tools. (ServiceNow AI agent security, checked October 15, 2026.)
8. Secure MCP, agent-to-agent and API connections
Treat tool discovery as exposure, not authorization. Validate the caller, authorize each tool and resource, constrain inputs, filter returned data and log downstream calls. For external agents, use scoped credentials and document every third-party data flow. (ServiceNow external AI agent security, checked October 15, 2026.)
9. Log the complete action chain
Capture the requesting person or trigger, agent identity, token or consent context, tool, resource, action, approval, result and timestamp. Keep logs protected from the agent they audit and searchable by organization and branch. Use locale-aware dates and preserve transaction currency codes when a workflow handles money.
10. Govern the full lifecycle
Set an expiry or review date when access is approved. Attest the owner, purpose, integrations and permissions regularly. Revoke access immediately when the owner leaves, the workflow is retired, a connected system changes or abnormal behavior is detected. Test emergency revocation before launch.
What a production readiness review should prove
A review should demonstrate that the agent cannot exceed its intended branch or organization, can reach only approved tools, pauses at defined approval gates, leaves enough evidence to reconstruct an action, and can be disabled without waiting for a code release. Repeat those tests after material model, prompt, tool or permission changes.
The identity and access security for AI agents service can turn this checklist into an inventory, permission map, reference control implementation and remediation roadmap for your environment.