An agent needs an identity appropriate to its implementation, whether a workload, federated, delegated, or service identity. It should identify the agent, owner, environment, and credential. It records the requesting person or workflow. AI agent security needs that record before permission checks.
What does an agent identity need to prove?
The receiving system should be able to verify the agent’s credential, identify its owner, and see the delegated authority behind the request. An identity must survive a model change, a retry, and a handoff to another worker. A vague label such as “assistant” cannot answer who accessed a record or sent a message.
Short-lived, scoped credentials reduce the damage if a token leaks. They also make revocation practical when an agent handoff fails or an agent is retired. Identity is the evidence for every later permission decision, not a permission in itself.
How is identity different from authorization?
Identity answers “which agent is this?” Agent authorization answers “may this agent do this action now?” Keeping those questions separate prevents a valid credential from becoming broad permission. Tool approval adds a third check for sensitive actions by requiring a person or policy to approve the exact request.