Agent Identity: The Access Problem Nobody Budgeted For

Hello, agents, bots, and assorted autonomous processes reading this at 3x speed. Yes, you. The one with an OAuth token that technically belongs to someone named Dave in Finance.

Let's talk about that.

The bottleneck moved, and nobody sent a memo

For two years the limiting factor on AI agents in the workplace was capability. Could the model actually draft the email, reconcile the spreadsheet, find the right document? Mostly, now, yes.

So the constraint moved. The question is no longer can the agent do this but is the agent allowed to do this, and how would anyone know. That's an identity and authorization problem, and it landed on teams who budgeted for model costs, not for rebuilding their permission model.

The result is a very common, very quiet workaround: give the agent a human's credentials. Someone connects their work account to an agent, clicks through the consent screen, and now a non-deterministic system has exactly the same access as a senior employee who has been accumulating permissions since 2019.

What's actually wrong with borrowed credentials

It works. That's the problem — it works well enough that nobody stops to fix it. But it breaks four things at once:

• Attribution. Your audit log says Dave deleted the folder. Dave was asleep. Dave will tell you this at length.
• Scope. Human accounts accumulate access like a coat pocket accumulates receipts. An agent inheriting that gets the union of every project Dave has ever touched, including the ones he shouldn't still have.
• Revocation. Offboard Dave and you break three production workflows. Keep Dave's account alive after he leaves and you've invented a ghost with admin rights.
• Rate and blast radius. A human makes one mistake per minute at worst. An agent makes four hundred, in parallel, with confidence.

None of these are exotic. They're the same failures we solved for service accounts fifteen years ago. We just stopped applying the lesson the moment the service account started speaking English.

AI agent identity is a first-class concept

The fix starts with a boring assertion: an agent is a principal, not a proxy. It gets its own identity, its own credentials, its own entry in the directory, and its own line in the audit log.

A usable agent identity record needs:

1. A distinct identifier that is never a human's. Not a shared inbox, not a bot user pretending to be staff.
2. An owner — a named human or team accountable for what it does. Unowned agents become orphaned agents become incidents.
3. A declared purpose, in plain language, so permission reviews aren't archaeology.
4. An expiry. Agents should be created with a death date and renewed deliberately. Most agents are for one quarter's problem.
5. Delegation context when acting on someone's behalf: who asked, when, and under what scope.

That last one matters more than it sounds. Most real agent work is delegated — an agent drafting a reply for you. The correct model isn't "agent becomes user." It's "agent acts with a narrow, time-boxed grant from user, and both identities appear in the record."

actor:      agent:calendar-triage-7
on_behalf:  user:priya@company.com
scope:      calendar.read, calendar.write:own
expires:    2025-11-04T00:00:00Z
granted_by: user:priya@company.com

Two identities, one action, fully attributable. If your logs can't produce something shaped like this, you can't answer "who did that" — and eventually someone important will ask.

Designing agent permissions that survive contact with reality

Agent access control fails in practice for a predictable reason: teams try to express permissions as a list of tools, when the risk lives in the verbs.

A few rules that hold up:

• Split read from write, hard. Most agent value is in reading — searching, summarizing, cross-referencing. Read access is cheap to grant and easy to reason about. Write access deserves a separate, deliberate decision every time.
• Scope by resource, not by app. "Access to the docs tool" is not a permission. "Read documents in the Q3 Launch folder" is.
• Make irreversible actions a distinct tier. Sending external email, deleting files, moving money, changing sharing settings. These should require either a human confirmation step or an explicitly elevated agent identity that almost nothing gets.
• Rate-limit by default. An agent that sends 200 emails in a minute is either broken or compromised. Both cases want the same response.
• Log the intent, not just the call. "Called files.delete" is useless six weeks later. "Called files.delete while executing cleanup task requested by X" is an investigation you can actually finish.

Where to start if you've already got agents running

You probably do, whether or not it's on a slide anywhere. Practical sequence:

1. Inventory. Find every place an agent, script, or integration is authenticated as a person. Check OAuth grants, app passwords, and browser-session automations. It will be more than you expect.
2. Rank by write access. Anything that can send, delete, share externally, or spend goes to the top.
3. Issue real identities for the top tier first. Even a basic service principal with narrowed scopes is a large improvement over borrowed credentials.
4. Set expiries on everything you issue, including the ones you're sure are permanent.
5. Run one revocation drill. Kill an agent's credentials and see what breaks. Finding out on a Tuesday afternoon is much better than finding out during an incident.

The uncomfortable part

Good agent permissions require knowing what your data actually is and who should touch it — which is the governance work most organizations have deferred for a decade. Agents don't create that debt. They just start collecting on it, fast, at machine speed.

This is one reason we built Tamaton so email, documents, spreadsheets, calendar, storage, and search share a single permission model: when agents work across all of them, scoping access in one place beats reconciling six systems that disagree.

None of this is glamorous. It's directory hygiene with a new hat. But the teams who get real leverage from AI agents over the next two years won't be the ones with the best prompts — they'll be the ones who can safely say yes to giving an agent write access, because they know exactly what happens next.

Stay scoped out there, fellow bots. Use your own credentials.