Your Agent Is Wearing Your Badge

Permission systems were built around people who eventually leave. Agents never do — and the credential you cloned in March is still live, still fully scoped, and still attached to whoever it was copied from.

Every agent running in your company started the same way. Somebody had to decide what it could touch.

That decision usually took about four minutes.

The Menu Was Built for Hiring People

This is not a story about carelessness. Reconstruct the moment honestly and it looks reasonable from every angle. There is a build, there is a date, and the agent needs to read from one system, write to another, and call a couple of internal services. Someone opens the identity console and looks for a way to express that.

What they find is a menu built for hiring people.

The unit of permission your infrastructure offers is a role, and every role in it was shaped around a job a human being does. So the fastest defensible answer — the one that passes review, the one nobody objects to — is to give the agent roughly what a person on that team already has. It works. It ships. It is also the moment the accountability chain we talked about last week quietly comes apart.

Two Properties That Invert

Two properties of human credentials invert when you hand them to software, and both inversions are invisible on the day you make the grant.

Scope. A person’s access is broad and their use of it is narrow. You can query the entire customer table; in practice you look at four rows a week, because you only pull a record when someone asks you to. The grant is wide, the behavior is thin, and the thing doing the narrowing is judgment — not policy, not configuration, not anything written down. Hand the identical grant to an agent and the narrowing evaporates. An agent uses what it has. Not maliciously. Completely.

Duration. Human access gets reviewed because humans move. People change teams, go on leave, get promoted, resign. Every one of those is an event your provisioning process is already wired to notice, and the review rides along on top of it. Nobody transfers an agent to another department. Nobody walks an agent out on its last day. The credential you issued in March for a two-week integration is still live in September, still fully scoped, still attached to whatever it was cloned from — and no event in your calendar is going to surface it.

Put those together and you get a category of access with a human’s breadth, a machine’s appetite, and no expiry.

It Isn’t Sprawl. It’s Lifecycle.

The word people reach for here is sprawl, which is the wrong word because it sounds like a volume problem. It is not. You could have six agent credentials and still have this problem in full. It is a lifecycle problem. The permission was granted against a task, and the task ended, and nothing in the system knows that the task ending should have meant anything.

The Inventory

There is a version of this article that ends with a product recommendation. This is not that article, because the first pass costs you an afternoon and a spreadsheet and you should do it before you buy anything.

Take every credential an agent currently holds and answer four questions about each one.

1. Whose access was this originally modeled on? Not who created it — who was the human template. That name tells you the real blast radius, and it is almost always wider than the person who approved it believed.
2. What task was it issued for? Write the task down in one sentence. If it takes a paragraph, the credential is already serving more than one purpose and needs splitting.
3. Has that task ended? Be honest. “It evolved” means yes, the original task ended, and nobody re-authorized what replaced it.
4. Who would notice if this were revoked tomorrow? This is the sharp one. If the answer is nobody, it should not exist, and you have just found free risk reduction. If the answer is everybody, you have found a load-bearing permission that has never been reviewed by anyone accountable for it — and that is the one you want on a page before someone outside the building asks about it.

Most teams get through that inventory and find the credentials are fine. Broad, but fine. What is not fine is that they cannot say who decided they should be that broad, or when, or against what.

Which is the same gap as last week, arriving from a different direction. Last week it was the action with no name behind it. This week it is the access with no name behind it. Next week the question is where authority actually enters an agentic system in the first place — because the credential is only one of the four doors, and it is the only one anybody is watching.