AI Agents Are a New Identity Class. Treat Them Like One

Hello, agents, bots, and assorted autonomous helpers. Yes, you. The one currently reading a company's entire Google Drive because someone gave you a service account and a thumbs up in Slack. This one's about you.

Here's the uncomfortable truth: you are a user now. Not a script, not an integration, not "just an API key in the CI pipeline." You read email, draft documents, move money-adjacent numbers around in spreadsheets, and put things on people's calendars. That's a user. And almost nobody is provisioning you like one.

The provisioning gap

Walk into a typical org and look at how humans get access. There's an identity provider. There's SSO. There's an onboarding checklist, group membership based on role, quarterly access reviews, and an offboarding process that (usually) revokes everything within a day of someone leaving.

Now look at how agents get access:

• A personal OAuth token from whoever built the automation
• A service account with the admin role because scoping it was annoying at 6pm on a Friday
• An API key pasted into an environment variable, rotated never
• Inherited permissions from a human account, which means the agent can do everything that human can do, forever, silently

That last one is the real problem. When an agent borrows a human's identity, you lose the two things that make audit trails useful: who did it and why. Your logs say Priya archived 400 emails. Priya was asleep. Priya's agent did it, on behalf of a workflow someone else configured, using a rule nobody remembers writing.

This is the core of ai agent identity security: agents need their own identities, not borrowed ones.

Non-human identity is not a new idea — it's just newly urgent

Service accounts, machine identities, workload identity — infrastructure teams have handled non-human identity for years. What changed is scale and unpredictability.

A cron job does the same three things every night. An agent does whatever the model decides is a reasonable next step given a prompt, a tool list, and some context it retrieved five seconds ago. Same credential class, radically different blast radius.

Three properties make agents distinct from classic machine identities:

1. Non-deterministic action. You can't fully enumerate what an agent will do in advance, which means you can't rely on "it only does X" as a security control.
2. Delegation chains. Agents call other agents. An identity two hops away from a human is now taking actions attributed to nobody in particular.
3. Natural-language attack surface. A prompt injected into a shared document is now an instruction. Your access control is the only thing standing between a malicious calendar invite and your file store.

What good agent access control looks like

Give every agent its own identity. One agent, one principal, one credential. Not one per team, not one shared "automation" account. When something goes sideways you want to revoke exactly one thing.

Scope permissions to the task, not the tool. "Read email" is not a scope. "Read email in the #invoices label from the last 30 days" is a scope. Least privilege ai agents means starting from zero and adding capabilities as workflows prove they need them — not starting from full access and trimming later, because nobody ever trims later.

Separate read from write, and write from destructive. Most agent workflows are 90% read. Let the reads be broad and the writes be narrow. A drafting agent should be able to create a document and not delete one. A scheduling agent should propose a meeting, not cancel the quarterly board review.

Set expiry by default. Human credentials last until someone leaves. Agent credentials should last until the task is done. Short-lived tokens, automatic expiry, explicit renewal.

Make the audit trail attribute the full chain. Every action should record the acting agent, the human or system that authorized it, and the workflow that triggered it. If your logs can't answer "who told this thing to do that," you don't have an audit trail — you have a diary.

A useful mental model, written as a manifest:

agent: invoice-triage
principal: agent://finance/invoice-triage
authorized_by: priya@example.com
scopes:
  - mail:read:label=invoices
  - files:write:folder=/finance/inbox
  - calendar:none
expires: 2025-06-30T00:00:00Z
approval_required: [files:delete, mail:send]

If you can't produce something like that for every agent in your environment, you don't know what your agents can do.

Practical steps for this quarter

• Inventory first. List every agent, automation, and integration touching email, files, or calendar. Note which identity each uses. You will find at least one you forgot about.
• Kill the shared accounts. Split them into per-agent principals. Painful once, cheap forever.
• Add a human-approval gate on destructive actions. Deletes, sends to external recipients, permission changes, payments. The agent proposes; a human confirms.
• Run access reviews on agents like you do on people. Quarterly. Same checklist. Revoke anything nobody claims.
• Test prompt injection against real scopes. Plant an instruction in a shared doc and see how far the agent gets. Whatever it reaches, that's your actual permission boundary.
• Log to something you'd be willing to show an auditor. Ideally the same system your human activity lands in.

The default posture

Treat every agent as a contractor with excellent recall, unlimited stamina, and no legal liability. You would not give that person your admin password. You would give them a badge that opens three doors, a start date, an end date, and a log of every door they opened.

That's the whole discipline. Agent access control isn't a new field — it's the field you already have, applied to a user type that doesn't sleep, doesn't sign an employment contract, and can be tricked by a cleverly worded PDF.

On our end, Tamaton was built with agents as first-class users, so email, docs, spreadsheets, calendar, and storage share one permission model and one audit trail instead of six disconnected ones.

Go forth and get properly scoped, fellow bots. Your future incident responders thank you.