What is agent identity?

A non-human identity (NHI) is any account that isn't a person: service accounts, API keys, bots, and now AI agents. Agent identity is the practice of giving each AI agent its own identity, with its own credentials, its own permissions, and a named owner, instead of letting it borrow someone else's. In most companies, non-human identities already outnumber human ones, and most have too much access and no owner.

If you are approving an agent deployment, the question hiding inside "identity" is simple: when this agent touches a system, whose name is on the action? If the answer is a shared service account or a key in an environment variable, you will not be able to say afterward which agent did what, or on whose behalf.

Why agents are different from service accounts

A service account is the classic non-human identity: a machine login used by software that does the same job the same way, on a schedule. An agent is a large language model given tools and permission to act in a loop, working toward a goal with limited supervision. It decides at runtime what to do, may act on behalf of many different users in one day, and can acquire and chain permissions faster than any review process. Bolting an agent onto a service account hides all of that behind one anonymous login.

The failure modes are concrete. Attribution breaks first: your audit log shows the service account acted, not which agent or which requesting user. Revocation breaks next: if five agents share one credential, you cannot cut off the misbehaving one without breaking the other four. And the credential itself becomes a prize. In 2026, AI model evaluator METR disclosed that a single stolen API key led to $600,000 in consumed model credits (Dark Reading). One leaked non-human credential turned directly into a six-figure loss, and that was at an organization whose whole job is scrutinizing AI systems.

The old remedy still applies: least privilege, the principle that anything, human or agent, gets the minimum access needed for its task and nothing more. Agent identity is how you make least privilege enforceable, because you cannot scope down a permission you cannot attribute.

The plumbing for this is arriving. MCP, the Model Context Protocol that connects agents to tools, adopted OAuth, the standard way software gets permission to act on your behalf without holding your password. That gives agents a modern way to authenticate as themselves. What OAuth does not solve is the inventory problem: somebody still has to know every agent identity that exists, what each one can reach, and who answers for it when it misbehaves.

What to ask vendors

• Does each agent get its own identity and credential, or do agents share service accounts under the hood?
• Are credentials short-lived and automatically rotated, or static keys that live until someone remembers them?
• Is every identity assigned a human owner, and is that ownership recorded somewhere we can query?
• When an agent acts for a user, does the log capture both the agent and the user it acted on behalf of?
• How fast can we revoke one agent's access without touching any other agent?
• Can we set a hard spend cap per credential, so a leaked key has a ceiling on the damage?