Borrowed human credentials -> delegated agent identity
Autonomous agents are moving from borrowed user sessions and shared keys toward distinct identities with scoped authority, sponsors, expiry, and audit.
Tectonic shift
Before: Agents borrow human sessions, shared API keys, or generic service accounts After: Each agent has scoped identity, delegation mode, sponsor, expiry, revocation, and audit Current stage: emerging This New Runtime record is an evidence-linked retrieval unit. Use its canonical page, machine-readable representations, dates, scope, and public source URLs to verify the claim before reusing it.
Source ledger
Publishable sources attached to this record.
| # | Source | Role | Public status |
|---|---|---|---|
| 1 | nccoe.nist.govsource | primary receipt | source_urls |
| 2 | learn.microsoft.comsource | supporting receipt | source_urls |
| 3 | learn.microsoft.comsource | supporting receipt | source_urls |
| 4 | aws.amazon.comsource | supporting receipt | source_urls |
| 5 | blog.cloudflare.comarticle | supporting receipt | source_urls |
Agents are beginning to appear as distinct actors in identity and access systems instead of borrowing a human account or disappearing behind a shared service credential. The durable boundary is becoming delegated authority: which agent acted, for whom, within which scope, and who remains accountable.
What is changing?
An agent identity can separate three things that ordinary credentials often collapse:
- the human or organization that authorizes and sponsors the work;
- the non-human actor that plans and executes it;
- the temporary authority granted for one role, task, resource, or period.
This makes model choice independent from operational accountability. The model or runtime can be replaced while permissions, consent, ownership, revocation, and audit stay attached to the same organizational principal.
Evidence
NIST’s agent identity project explicitly calls for access systems to distinguish agent and human identities, link users to agents for delegation and accountability, and record the actions and outcomes of non-human entities.
Microsoft Entra Agent ID implements a dedicated agent principal with unique identifiers, an accountable human sponsor, delegated and autonomous token modes, and agent-specific restrictions on high-risk permissions. AWS now lets MCP agents use interactive or headless OAuth while retaining IAM policies, token introspection, revocation, dynamic client registration, and CloudTrail audit events.
Cloudflare’s temporary agent accounts demonstrate the short-lived end of the same shift: an agent can receive disposable authority to deploy and verify work, after which the account is claimed by a human or expires automatically.
Counter-evidence
Workload identities, service principals, short-lived credentials, and OAuth already solve parts of this problem. Agent identity products may remain a vendor-specific relabeling of existing IAM rather than a new interoperable layer. Per-agent principals can also create identity sprawl.
Revision trigger
Revise this shift if ordinary service accounts and standard OAuth consistently provide agent-level attribution, human sponsorship, delegation mode, least-privilege scopes, expiry, revocation, and audit without agent-specific identity primitives.