Agent Identity

An agent should be a first-class principal in your identity system — with its own accounts, credentials, and lifecycle — rather than a puppet borrowing whatever the invoking user can do.

What it is

Agent identity is the practice of giving each AI agent (and each compartment it operates in) a distinct, governable identity instead of letting it act anonymously through a user's session or a shared service account. Forrester's AEGIS framework calls for treating agents as "a new identity class"; theCUBE Research argues they must be "production-grade identities from the start, not simply application features"; and BigID groups them with service accounts and automation workflows as non-human identities that need the same rigor as human ones.

Claude's engineering team describes the concrete shift: replacing the question "what can this user do?" with "what can this agent do in this compartment?" In their model, an agent operating in a shared channel holds workspace-level accounts tied to that channel, rather than impersonating whichever teammate last spoke to it.

Why it matters

• "Act as the user" breaks down in multiplayer and autonomous settings. When several people interact with one agent, or the agent keeps working long after the request, there is no single user whose permissions cleanly apply (Claude/Anthropic).
• Scale makes borrowed identity ungovernable. Krista Case (theCUBE Research) cites projections of agents outnumbering human workers up to 100-to-1 in some environments; identity governance built around per-human accounts cannot absorb that.
• Invisible identity means invisible risk. BigID's Neil Patel notes agents often "inherit permissions through APIs and dynamic workflows" and remain unseen by security teams — a distinct identity is the prerequisite for seeing, auditing, and revoking anything. See Discovery & Governance.

Best practices

• Register every agent in a directory with an owner, a purpose, and lifecycle events (create, rotate, retire) — Okta's guidance for its identity fabric, echoed by AEGIS's "build inventory systems" step.
• Scope identity to a compartment, not a person. Claude's channel model gives each private channel its own identity with boundary enforcement; public channels share a workspace identity. Configure each compartment to the lowest-privileged member's needs.
• Keep personal contexts personal. Direct, single-user interactions can stay on the user's own delegated identity — see Delegated Authority for that model.
• Govern human and non-human identities together with consistent, data-centric policies rather than a separate, weaker regime for machines (BigID).

Examples

• An engineering channel's agent identity holds GitHub and data-warehouse write access; the legal channel's identity cannot reach code repositories at all; DMs stay on the individual's own accounts (Claude/Anthropic).
• A CRM agent is confined to a single private space, so a prompt from any other context simply has no credential path to customer data (Claude/Anthropic).
• An enterprise IdP registers each agent and applies Cross App Access so every app-to-app connection the agent makes is centrally visible and revocable (Okta).