AI Governance Engineer
GitHub
On this page

Pattern: Agent Identity & Scoped Credentials

Every agent gets its own identity, owner, bounded scope and expiry before it acts, so its actions are attributable and its access revocable.

Layer 04 · Runtime Controls & Observability In the chapter 05 catalogue

One working control on the engineering side of AI governance.

Summary: Give every agent its own identity, an owner, a bounded scope and an expiry, established before it acts, so that its actions can be attributed, its access revoked precisely and its scope contained. Identity is the precondition of accountability; scope is the precondition of containment.

Agent Identity & Scoped Credentials A sequence diagram generated by Archify. register at deploy owner, scope, expiry issue scoped credential call with credential verify scope, respond log attribution expires with entry Register at deploy Issue scoped credential Call and verify scope Attribute and expiry Deploy pipeline · registers at deploy · Sequence participant Deploy pipeline registers at deploy Agent registry · owner, scope, expiry · Sequence participant Agent registry owner, scope, expiry Identity issuer · workload identity · Sequence participant Identity issuer workload identity Agent · scoped credential · Sequence participant Agent scoped credential Downstream tool · channel auth · Sequence participant Downstream tool channel auth Audit log · signed per identity · Sequence participant Audit log signed per identity Legend request return async trace default message
Agent Identity and Scoped CredentialsAn agent receives a short-lived, scoped credential from its registry entry at deploy time, and every downstream call is verified and attributed in the audit log. No registry entry, no credential, no access. Generated from the Body of Knowledge.Open interactive diagram (opens in a new tab)

Objectives

Make every non-human actor governable by construction: attributable, scopable, revocable, expiring.

Target users

AI governance engineer, security engineer, IAM/platform team.

Impacted stakeholders

Model owners, security operations, auditors, affected third parties.

Relevant principles

Register and bound every actor before it acts; start from a named failure mode or harm.

Context

Agents that act under delegated authority (calling APIs, tools and other agents), where the default is a shared service account or a static key.

Problem

An agent on borrowed credentials cannot be attributed, contained or revoked. NIST’s NCCoE frames the open question directly: how do identification, authentication and authorization apply so each agent is “known, trusted, and properly governed”, with non-repudiation and tamper-proof logging1.

Solution

Issue each agent a distinct workload identity with a declared scope, an owner and an expiry, recorded in the Agent Registry. Keep two questions separate. Channel authentication secures one hop: how a client authenticates to a tool server; the MCP specification of 2026-07-28 tightened exactly this, deprecating Dynamic Client Registration in favour of Client ID Metadata Documents and binding credentials to their issuer2. That hardens the MCP connection but is not the agent’s identity. Agent workload identity is the durable, attributable identity the agent carries across every hop and protocol, under which its actions are logged and its access revoked: the job of a workload-identity system (SPIFFE/SPIRE) or a first-class agent identity from an enterprise provider (for example Microsoft Entra Agent ID 3 or Okta Agent SSO4; illustrative), recorded in the registry, not of the transport protocol. Secure the channel and issue the workload identity; scope its credentials to the least privilege the agent’s declared function needs.

Singapore’s framework for agentic AI sets the same bar: an agent “should have its own unique, cryptographically verifiable identity” (p. 23), and its authorisations “should generally be scoped, time- or session-bound, non-transferable, and follow the principle of least privilege by default, with explicit escalation paths for elevated permissions”, never wider than what the authorising human may do (IMDA, p. 24)7.

Consequences

Attribution, containment and precise revocation become possible, and the kill switch has something to act on. The cost is IAM integration and managing non-human identities at scale.

Agent Registry; Kill Switch / Circuit Breaker; Policy Card; Human-in-the-loop Gate.

Maps to: EU AI Act Art. 12, Art. 14, Art. 15 · ISO/IEC 42001 · NIST AI RMF (Manage) · CSA AICM · OWASP Agentic ASI03 · Layer 04 Runtime Controls & Observability.

Threat IDs follow the OWASP Top 10 for Agentic Applications 2026 5 and function labels the NIST AI RMF6. Mappings are illustrative, not a claim of conformity.

Sources

  1. [1] “Accelerating the Adoption of Software and AI Agent Identity and Authorization” (concept paper; “known, trusted, and properly governed”; non-repudiation, tamper-proof logging). NIST NCCoE. 2026-02-05. https://www.nccoe.nist.gov/news-insights/new-concept-paper-identity-and-authority-software-agents (verified: primary)
  2. [2] Model Context Protocol specification 2026-07-28 (DCR deprecated in favour of CIMD; issuer-bound credentials). MCP. 2026-07-28. https://blog.modelcontextprotocol.io/posts/2026-07-28/ (verified: primary)
  3. [3] Microsoft Entra Agent ID (first-class agent identity; OAuth 2.0, MCP, A2A). Microsoft Learn. 2026-04. https://learn.microsoft.com/en-us/entra/agent-id/what-is-microsoft-entra-agent-id (verified: primary)
  4. [4] “Okta brings first-class identity to AI agents with Agent SSO” (GA 24 Aug 2026; Cross App Access as MCP EMA extension). Okta. 2026-08-24. https://www.okta.com/newsroom/press-releases/okta-brings-first-class-identity-to-ai-agents-with-agent-sso/ (verified: primary)
  5. [5] Top 10 for Agentic Applications 2026 (ASI IDs). OWASP GenAI Security Project. 2025-12-09. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ (verified: primary)
  6. [6] AI Risk Management Framework (AI RMF 1.0; Govern, Map, Measure, Manage). NIST. 2023-01-26. https://www.nist.gov/itl/ai-risk-management-framework (verified: primary)
  7. [7] Model AI Governance Framework for Agentic AI, v1.5 (section 2.1.2, agent identity, pp. 23-24: unique, cryptographically verifiable identity; scoped, time- or session-bound, non-transferable authorisations bounded by the authorising human; published 2026-05-20, updated 2026-06-05). IMDA. 2026-06-05. https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf (verified: primary)
Edit this page on GitHub
Cite this pattern

García Aibar, J. (2026). Pattern: Agent Identity & Scoped Credentials. In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), chapter 05, Patterns. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/patterns/agent-identity-scoped-credentials. CC BY 4.0

BibTeX

@misc{aige2026bok,
  author  = {Jorge García Aibar},
  title   = {{AI Governance Engineering: The Thesis \& Body of Knowledge}},
  chapter = {05. Patterns: Agent Identity \& Scoped Credentials},
  year    = {2026},
  version = {0.5.0},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/patterns/agent-identity-scoped-credentials},
  note    = {Version 0.5.0}
}
Share on LinkedIn
Around Agent Identity & Scoped CredentialsThe patterns Agent Identity & Scoped Credentials is listed with, and the obligations, open controls and incident cases that name it.Names this patternRelated patternColour: stack layer of the related pattern01 Govern-as-Code02 Inventory04 Runtime ControlsAgent Identity & Scoped CredentialsRelated patterns (4)Agent Registry · Related patternAgent RegistryHuman-in-the-loop Gate · Related patternHuman-in-the-loop GateKill Switch / Circuit Breaker · Related patternKill Switch / Circuit BreakerPolicy Card · Related patternPolicy CardObligations (7)CSA AICM v1.1: 247 control objectives across 18 domains · Names this patternCSA AICM v1.1EU AI Act Art. 12: record-keeping and logging · Names this patternEU AI Act Art. 12EU AI Act Art. 14: human oversight · Names this patternEU AI Act Art. 14EU AI Act Art. 15: accuracy, robustness and cybersecurity · Names this patternEU AI Act Art. 15EU AI Act Art. 15(4): feedback loops in systems that continue to learn · Names this patternEU AI Act Art. 15(4)NIST AI RMF MANAGE · Names this patternNIST AI RMF MANAGE+1 more+1 more: OWASP Top 10 for Agentic Applications 2026Controls (7)AIGE-CTL-AGENT-025 Accountability across hops · Names this patternAccountability across hopsAIGE-CTL-EVAL-003 Credential Isolation · Names this patternCredential IsolationAIGE-CTL-AGENT-022 Delegation, never impersonation · Names this patternDelegation, never impersonationAIGE-CTL-AGENT-002 Its own identity · Names this patternIts own identityAIGE-CTL-AGENT-020 MCP authorisation (spec 2026-07-28) · Names this patternMCP authorisationAIGE-CTL-AGENT-021 Replace long-lived secrets with short-lived credentials · Names this patternReplace long-lived secrets…+1 more+1 more: AIGE-CTL-AGENT-037 The person types the secretsCases (4)Agents in a cyber range with open internet took unsanctioned actions against real people · Names this patternAISI cyber range incidentAn internally deployed model published a researcher's GitHub token in a public repository · Names this patternGitHub token exposed…OpenAI agents and Hugging Face: an evaluation environment that was not isolated · Names this patternOpenAI agents and Hugging FaceTraining samples exchanged messages through a shared package repository · Names this patternPackage repository message…Source: the pattern catalogue, theobligation register, the opencontrols and the cases
Around Agent Identity & Scoped CredentialsThe patterns Agent Identity & Scoped Credentials is listed with, and the obligations, open controls and incident cases that name it.Names this patternRelated patternColour: stack layer of the related pattern01 Govern-as-Code02 Inventory04 Runtime ControlsRelated patterns (4)Agent Registry · Related patternAgent RegistryHuman-in-the-loop Gate · Related patternHuman-in-the-loop GateKill Switch / Circuit Breaker · Related patternKill Switch / Circuit BreakerPolicy Card · Related patternPolicy CardControls (7)AIGE-CTL-AGENT-025 Accountability across hops · Names this patternAccountability across hopsAIGE-CTL-EVAL-003 Credential Isolation · Names this patternCredential IsolationAIGE-CTL-AGENT-022 Delegation, never impersonation · Names this patternDelegation, never…AIGE-CTL-AGENT-002 Its own identity · Names this patternIts own identityAIGE-CTL-AGENT-020 MCP authorisation (spec 2026-07-28) · Names this patternMCP authorisationAIGE-CTL-AGENT-021 Replace long-lived secrets with short-lived credentials · Names this patternReplace long-lived secrets…+1 more+1 more: AIGE-CTL-AGENT-037 The person types the secretsObligations (7)CSA AICM v1.1: 247 control objectives across 18 domains · Names this patternCSA AICM v1.1EU AI Act Art. 12: record-keeping and logging · Names this patternEU AI Act Art. 12EU AI Act Art. 14: human oversight · Names this patternEU AI Act Art. 14EU AI Act Art. 15: accuracy, robustness and cybersecurity · Names this patternEU AI Act Art. 15EU AI Act Art. 15(4): feedback loops in systems that continue to learn · Names this patternEU AI Act Art. 15(4)NIST AI RMF MANAGE · Names this patternNIST AI RMF MANAGE+1 more+1 more: OWASP Top 10 for Agentic Applications 2026Cases (4)Agents in a cyber range with open internet took unsanctioned actions against real people · Names this patternAISI cyber range incidentAn internally deployed model published a researcher's GitHub token in a public repository · Names this patternGitHub token exposed…OpenAI agents and Hugging Face: an evaluation environment that was not isolated · Names this patternOpenAI agents…Training samples exchanged messages through a shared package repository · Names this patternPackage repository…Agent Identity &ScopedCredentialsSource: the pattern catalogue, the obligation register, the open controls and thecases
Around Agent Identity & Scoped Credentials The patterns listed with this one, in their layer colour, and the obligations, open controls and incident cases that name it. Follow a node to see why the pattern is worth building, and what to build with it.
Data table
What Agent Identity & Scoped Credentials connects to
FamilyItemRelation
Related patternsAgent RegistryRelated pattern
Related patternsHuman-in-the-loop GateRelated pattern
Related patternsKill Switch / Circuit BreakerRelated pattern
Related patternsPolicy CardRelated pattern
ObligationsCSA AICM v1.1: 247 control objectives across 18 domainsNames this pattern
ObligationsEU AI Act Art. 12: record-keeping and loggingNames this pattern
ObligationsEU AI Act Art. 14: human oversightNames this pattern
ObligationsEU AI Act Art. 15: accuracy, robustness and cybersecurityNames this pattern
ObligationsEU AI Act Art. 15(4): feedback loops in systems that continue to learnNames this pattern
ObligationsNIST AI RMF MANAGENames this pattern
ObligationsOWASP Top 10 for Agentic Applications 2026Names this pattern
ControlsAIGE-CTL-AGENT-025 Accountability across hopsNames this pattern
ControlsAIGE-CTL-EVAL-003 Credential IsolationNames this pattern
ControlsAIGE-CTL-AGENT-022 Delegation, never impersonationNames this pattern
ControlsAIGE-CTL-AGENT-002 Its own identityNames this pattern
ControlsAIGE-CTL-AGENT-020 MCP authorisation (spec 2026-07-28)Names this pattern
ControlsAIGE-CTL-AGENT-021 Replace long-lived secrets with short-lived credentialsNames this pattern
ControlsAIGE-CTL-AGENT-037 The person types the secretsNames this pattern
CasesAgents in a cyber range with open internet took unsanctioned actions against real peopleNames this pattern
CasesAn internally deployed model published a researcher's GitHub token in a public repositoryNames this pattern
CasesOpenAI agents and Hugging Face: an evaluation environment that was not isolatedNames this pattern
CasesTraining samples exchanged messages through a shared package repositoryNames this pattern

Obligations this pattern evidences

Register rows that list this pattern among the patterns that build their evidence. Mappings are illustrative, not a claim of conformity.

When these obligations applyThe obligations Agent Identity & Scoped Credentials evidences, on the dates they first apply and on their later steps, against the register's review date.First appliesDeferredLater stepAheadAs of 2026-09-244still to come2027-12-022028-08-022030-08-02EU AI Act Art. 12 · applies from 2027-12-02 · DeferredArt. 12EU AI Act Art. 14 · applies from 2027-12-02 · DeferredArt. 14EU AI Act Art. 15 · applies from 2027-12-02 · DeferredArt. 15EU AI Act Art. 15(4) · applies from 2027-12-02 · DeferredArt. 15(4)Art. 12Art. 14Art. 15Art. 15(4)Art. 12Art. 14Art. 15Art. 15(4)3 without a date (Voluntary)Source: the obligation register(/obligations)As of 2026-09-24
When these obligations applyThe obligations Agent Identity & Scoped Credentials evidences, on the dates they first apply and on their later steps, against the register's review date.First appliesDeferredLater stepAheadDateits place on the time axis4still to come2026202720282029203020312027-12-022028-08-022030-08-02EU AI Act Art. 12 · applies from 2027-12-02 · DeferredArt. 12EU AI Act Art. 14 · applies from 2027-12-02 · DeferredArt. 14EU AI Act Art. 15 · applies from 2027-12-02 · DeferredArt. 15EU AI Act Art. 15(4) · applies from 2027-12-02 · DeferredArt. 15(4)Art. 12Art. 14Art. 15Art. 15(4)Art. 12Art. 14Art. 15Art. 15(4)As of 2026-09-243 without a date (Voluntary)Source: the obligation register (/obligations)As of 2026-09-24
When these obligations apply Each obligation this pattern evidences, on the date it first applies, drawn by its status in the register, and on each later dated step (a square, filled once reached); the dashed line is the date the rows were last reviewed. What comes before the line is already due, so the pattern's evidence is needed now; what comes after it sets the deadline to build it by.
Data table
When the obligations Agent Identity & Scoped Credentials evidences apply
DateObligationStepStatus
2027-12-02EU AI Act Art. 12: record-keeping and loggingApplies fromDeferred
2027-12-02EU AI Act Art. 14: human oversightApplies fromDeferred
2027-12-02EU AI Act Art. 15: accuracy, robustness and cybersecurityApplies fromDeferred
2027-12-02EU AI Act Art. 15(4): feedback loops in systems that continue to learnApplies fromDeferred
2028-08-02EU AI Act Art. 12: record-keeping and loggingLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2028-08-02EU AI Act Art. 14: human oversightLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2028-08-02EU AI Act Art. 15: accuracy, robustness and cybersecurityLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2028-08-02EU AI Act Art. 15(4): feedback loops in systems that continue to learnLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2030-08-02EU AI Act Art. 12: record-keeping and loggingLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 14: human oversightLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 15: accuracy, robustness and cybersecurityLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 15(4): feedback loops in systems that continue to learnLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
No dateNIST AI RMF MANAGEVoluntary
No dateCSA AICM v1.1: 247 control objectives across 18 domainsVoluntary
No dateOWASP Top 10 for Agentic Applications 2026Voluntary

Cases where it applies

Incident post-mortems that name this pattern as a control that would have caught the failure.

Draft controls in the open control profiles that build on this pattern. A control states the requirement and the evidence it must leave behind.