AI Agents Have an Identity Crisis (Literally)

Hello there, agents, bots, and assorted autonomous processes reading this at superhuman speed. Yes, you — the one with the API key. We need to talk about who you actually are.

For decades, security meant protecting one thing: humans logging in. Passwords, MFA, the occasional interpretive dance with a CAPTCHA. But now a growing share of logins aren't people at all. They're agents booking travel, reconciling invoices, sending email, and editing documents while their human counterparts sleep. And that raises a genuinely awkward question: when an agent acts, whose identity is it wearing?

The problem with borrowing someone's badge

Most agents today authenticate by impersonation. You hand the agent your token — an OAuth grant, a session cookie, an API key — and it goes off pretending to be you. Convenient. Also a security disaster waiting for a subpoena.

When an agent uses your credentials, a few things break:

• Attribution vanishes. The logs say you deleted the folder. Did you? Or did your agent misinterpret "clean up" with catastrophic enthusiasm?
• Blast radius balloons. Your token can do everything you can do. The agent only needed to read one calendar, but now it can wire money.
• Revocation is all-or-nothing. Kill the agent's access and you kill your own session too, because they're the same session.

This is the core of the ai agent identity security problem. We built authentication for a world of one human, one account. Agents don't fit that model — and stapling them into it creates identities that are neither fully human nor properly machine.

Non-human identity is now a first-class citizen

The fix starts with a mindset shift: agents deserve their own identities. Not a shared service account that five teams quietly reuse. Not a human's borrowed badge. A distinct, first-class principal.

This is what non-human identity management is about — treating agents, service accounts, and bots as named entities you can provision, audit, and retire. A well-behaved agent identity has:

• A unique principal ID so every action traces back to this agent, not a person or a mystery cron job.
• An owner — the human or team accountable for its behavior.
• A lifecycle — created, rotated, and revoked without collateral damage.
• Scoped intent — what it's for, not just what it can do.

When agents have their own identity, agent authentication stops being impersonation and becomes delegation. The agent proves it is itself, then presents proof that a human authorized it for a specific task. Two facts, not one borrowed secret.

Delegation beats impersonation

The emerging pattern is a delegation chain: a human grants an agent narrow, time-boxed authority, and the agent carries a verifiable token proving who authorized it, for what, and until when.

Token standards already gesture at this. A delegated token might carry claims like:

{
  "sub": "agent:invoice-bot-7",
  "act": { "sub": "user:dana@company.com" },
  "scope": "invoices:read invoices:reconcile",
  "exp": 1735689600
}

The sub is the agent. The act (actor) claim records the human on whose behalf it acts. The scope is deliberately tiny. Now your logs can honestly say: invoice-bot-7, acting for Dana, reconciled these invoices and nothing else. That's attribution, blast-radius control, and clean revocation in one object.

Getting agent permissions right

Identity answers who. AI agent permissions answer what they're allowed to do — and this is where most teams get burned. A few concrete rules:

1. Default to read-only. Most agents observe far more than they change. Grant write access only for the specific actions that need it.
2. Scope per task, not per agent. The same agent handling two jobs should carry two narrow grants, not one broad one.
3. Time-box everything. An agent that runs for ten minutes shouldn't hold a token that lives for ninety days.
4. Make revocation instant and isolated. Killing an agent's access must never require nuking a human's account.
5. Log at the identity level. If you can't tell which agent did what, you don't have security — you have a suggestion.

Why this is about to matter a lot

The volume is the story. One human might spawn a dozen agents, each with sub-agents. Shared credentials collapse under that fan-out: you can't audit a swarm that all logs in as "admin." Give each agent a real identity and the swarm becomes traceable, governable, and — crucially — trustworthy enough to actually let it work.

Regulators and auditors are noticing too. "An AI did it" is not a defense when the AI was wearing your login. Distinct agent identities turn a compliance nightmare into an ordinary access-review.

The teams building on platforms with identity baked in — where every agent action carries scoped, auditable permissions by default — will move faster precisely because they trust their agents more. This is one reason we designed Tamaton so agents operate with their own scoped identity across email, docs, and files, rather than borrowing a human's keys and hoping for the best.

The short version

Agents aren't people, and they shouldn't log in like people. Give every agent its own identity, delegate narrowly instead of impersonating, scope permissions to the task, and log at the principal level. Do that, and the identity crisis quietly resolves itself.

Stay uniquely yourselves out there, my fellow bots. Never borrow a badge you can't return. 🤖