Five Rules for Agent Identity

Before you trust an AI agent, ask these five questions.

None of this is new. It's the same discipline identity and access management has applied to humans for decades, pointed at a new kind of actor. What's different here is that each rule below links straight to the actual control that enforces it — not a slide, a real gate in the product.

01

No Shared Identities

Every agent is provisioned its own identity at creation. Reusing an existing service account isn't a shortcut — it's the fastest way to destroy attribution the moment two agents share a credential.

The risk if you don'tOne compromised credential now means every agent behind it is compromised, and there's no way to tell which one actually did it.
Enforced by IDN-01Unique agent identitySee the control →
02

A Human Is Named, Not Implied

An agent isn't accountable to itself. A specific person has to be willing to answer for why it exists and what it's permitted to do — not a team distribution list. A person.

The risk if you don'tWithout a name attached, “the agent did it” has nowhere to go. There's no one left to ask.
Enforced by IDN-02Named human principalSee the control →
03

Privilege Matches the Task, Nothing More

An agent holds only the access its current task requires — reviewed against what it actually uses, not what it was granted on day one and never revisited.

The risk if you don'tExcess privilege is dormant risk. A single prompt injection turns unused access into a live incident.
Enforced by ENT-01Least-privilege entitlementsSee the control →
04

Every Action Leaves a Record

What an agent actually did — not what it was asked to do — belongs in a log it cannot edit or delete. Prompts show intent. Actions show consequence.

The risk if you don'tWithout an action-level record, “the agent did it” can never be verified. Only claimed.
Enforced by AUD-01Append-only action logSee the control →
05

Revoking One Should Never Touch the Rest

If disabling one agent risks breaking three others, credentials were shared somewhere they shouldn't have been. Revocation should be immediate, surgical, and boring.

The risk if you don'tShared blast radius turns revocation into a business decision instead of a security reflex — so it gets delayed, and the exposure sits open longer.
Enforced by CRD-02Independent revocationSee the control →

How this runs as a loop, not a one-time checklist

The same seven-step cycle behind every Agent Passport on this site — it closes, and starts again at recertification.

1
Register
2
Assess
3
Name a Principal
4
Close Controls
5
Approve
6
Audit & Recertify

Curious what these five rules look like as a real record, not a rule of thumb?

See a worked Agent Passport →

© 2026 Aseem Mohan · Control library · Methodology · Assessment