Identity and accountability for agents
Before a policy can authorize an action, a system needs to identify the subject making the request and the authority under which it acts. Agent identity connects a software process to an accountable principal without treating the two as interchangeable.
Identify both the agent and its principal
A useful identity model records the workload or agent instance, its owner or operator, the credentials used and the delegation that permits a particular task. Rotating agents, shared infrastructure and nested delegation make a single display name insufficient.
- Use identifiers that can be verified at the enforcement point.
- Bind credentials to a defined service and environment.
- Limit credential lifetime and access scope.
- Record the principal and delegation chain for consequential requests.
Attribution needs evidence
A log entry is not automatically a trustworthy audit record. Review integrity, timestamps, retention, access controls, correlation IDs and the way events are linked to external execution results.
Accountability also requires an operational process: an owner who can investigate, a way to correct identity or policy errors and a clear distinction between agent output and a human-approved decision.
Related controls
Identity answers who; mandates answer what authority was delegated; security provides a broader checklist for the system that stores and enforces those facts.