Agents get their own identity

An agent is a non-human actor holding credentials, and it needs the same care around access as any person or service would get. Two things, minimum: the narrowest key that does the job, scoped to one task and revocable on its own, and a trail that says the agent did this rather than a person. Access control tells you what an agent could do. The trail tells you what it did. You need both, and most setups have one.

Decision rights

Access is granted per task, not per agent, and the default is nothing. The question is not "what does this agent need to do its job on a normal day". It is "what does this credential do in the wrong hands", because that is the real scope of what you have handed over. An agent that needs to read one table does not get the database. An agent that needs to post to one channel does not get the workspace.

Trust does not live in the agent. It lives in what a compromised key can actually reach.

Memory and context

An agent needs to know its own boundaries before it starts work, otherwise it will hit a wall and go looking for a way round it, because that is what a helpful system does. The boundary is enforced by the platform and also written into the rules the agent reads, so it knows the wall is a wall and not a bug. See Context lives in files.

Execution

Credentials exist at the point of use, inside the runner or the environment, never inside the agent's instructions or its context. This is an AI-shaped risk that did not exist before: a secret pasted into a prompt can come back out through a log, a commit message, a draft reply, or a summary the agent wrote for someone else. Keep the secret where the code runs and give the agent a handle, not the key.

Governance

Rotation and revocation are routine, not annual. Agent responsibilities change every time someone edits a prompt or wires up a new tool, so credentials get reviewed when the task changes, not on a calendar. A key that was right for last month's task is over-scoped for this month's.

Observability

The audit trail has to answer three questions: what happened, who or what did it, and on whose behalf. Most trails answer the first and are assumed to answer the other two. Once you have humans and agents acting in the same systems, attribution stops being a nice-to-have. If the trail cannot tell you whether a person or an agent deleted the record, you do not have a trail, you have a timestamp.