Agent Identity Is the New Control Plane

Give each agent instance a cryptographic workload identity, not a string. SPIFFE/SPIRE is the reference shape: the runtime (a pod, a function) attests to the control plane with node identity, image digest, and namespace, and receives a short-lived SVID, an X.509 cert or JWT with a TTL measured in minutes. Nothing is written to disk, and rotation is automatic because the credential expires before anyone could exfiltrate it usefully.

That SVID is the input, not the grant. The agent exchanges it for a downstream credential through OAuth 2.0 token exchange (RFC 8693) at an STS, or asks Vault for a dynamic secret: a database role minted on demand, scoped to three tables, on a 15-minute lease that Vault revokes on expiry. The agent never holds a standing key to the database. It holds a lease.

Attribution rides the token, not the log line. The exchanged JWT carries the originating user or job in sub and the acting SPIFFE ID in act, the delegation written the way RFC 8693 defines it: the principal acted upon, and the agent acting on its behalf. Every downstream service then records the identity it actually authenticated, end to end, including the human the agent ultimately acted for. mTLS between services means the caller is proven, not asserted in a header anyone can forge. This is the access half of the agent reliability contract : a kill switch is only as good as your ability to name whose hand was on it.

Revocation then falls out for free. Delete the SPIRE entry or the Vault lease and that one agent’s credentials die inside the TTL window while the rest keep running. The off switch is per-principal, not global. If you cannot revoke one agent without stopping the others sharing its credential, what you hold is one shared key answering to many names, not a set of identities.

That last sentence is where most fleets actually live. An API key is not an identity; it is a password that can act, and a password copied across a fleet of agents tells you nothing about who did what. We handed agents long-lived keys, dropped them into config files and notebooks, and called it access control, then wondered why every incident review opens with archaeology. Picture the bill at 3:14am: an order-reconciliation agent starts issuing refunds it was never meant to touch, the pager fires, and the first question on the bridge is not how to fix the prompt. It is whether you can stop this one agent without killing the twelve others sharing its credential, and whether you can prove which records it already changed. The chain above is what turns that shrug into an answer.

What to hand the CISO

Vocabulary is not progress. Ask for a number and a date. The metric is credential blast radius: for a randomly chosen production agent, how many tools and rows can the credential it holds right now reach, and how long does it live? Track the median TTL of agent credentials and the share issued dynamically versus statically.

Then place your fleet on a four-rung ladder. Level 0 is shared long-lived keys in config, where one leak owns the fleet. Level 1 is per-agent static secrets in a vault: attributable, still long-lived. Level 2 is short-lived tokens, scoped per job, issued on request. Level 3 is attested workload identity feeding dynamic, leased credentials, with revocation and attribution by construction. Most “we have an agent platform” answers are Level 0 or 1 narrated in Level 3 language. The board’s job is three questions: which level are we on, on what date do we reach the next one, and what is the median credential TTL today. Those answers tell you more than any architecture diagram.

The point is narrow and worth stating once: this chain is what lets autonomy be revoked at the granularity of a single agent, which is the precondition for handing out more of it. Reliability is the ceiling on how much autonomy you can hand out; per-agent revocability is the floor that ceiling stands on. Get the issuing chain right and the next 3:14am page answers its own opening question before anyone reaches the bridge, stopping the one agent and reading back exactly which records it touched, instead of opening with archaeology.