Borrowed human credentials -> delegated agent identity
Autonomous agents are moving from borrowed user sessions and shared keys toward distinct identities with scoped authority, sponsors, expiry, and audit.
Tectonic shift
Before: Agents borrow human sessions, shared API keys, or generic service accounts After: Each agent has scoped identity, delegation mode, sponsor, expiry, revocation, and audit Current stage: emerging This New Runtime record is an evidence-linked retrieval unit. Use its canonical page, machine-readable representations, dates, scope, and public source URLs to verify the claim before reusing it.
Source ledger
Publishable sources attached to this record.
| # | Source | Role | Public status |
|---|---|---|---|
| 1 | nccoe.nist.govsource | primary receipt | source_urls |
| 2 | learn.microsoft.comsource | supporting receipt | source_urls |
| 3 | learn.microsoft.comsource | supporting receipt | source_urls |
| 4 | aws.amazon.comsource | supporting receipt | source_urls |
| 5 | blog.cloudflare.comarticle | supporting receipt | source_urls |
| 6 | x.comsource | supporting receipt | source_urls |
| 7 | aws.amazon.comsource | supporting receipt | source_urls |
| 8 | vercel.comsource | supporting receipt | source_urls |
Current state, as of Oct 9, 2026
Where this stands now
strengthening Multiple recent product releases now provide scoped, auditable agent identities with delegation, sponsorship, expiry, and revocation, confirming the shift away from borrowed human credentials.
Recent updates from Mem0, Google, Cloudflare, and Microsoft show concrete implementations of per‑agent keys, role‑based access, and audit logging. Microsoft Entra Agent ID explicitly defines delegation mode, sponsor, expiry, and revocation. Cloudflare OS isolates agent access behind user‑specific apps and service‑level controls, further reducing reliance on shared API keys.
The shift is now observable in production‑grade platforms, not just proposals. Builders can provision distinct service principals for agents, attach human sponsors, set time‑bounded scopes, and rely on built‑in audit trails for compliance.
Remaining gaps include uniform standards for sponsor verification and automated expiry enforcement across clouds.
What changed since the original text
- Cloudflare OS replaces broad API keys with isolated, user‑specific apps and service‑level controls, moving toward scoped agent authority. 1
- Mem0 Gateway, Google Gemini Credentials API, Cloudflare per‑Worker roles, and Microsoft Entra Agent ID provide per‑agent scoped identities with delegation, sponsorship, expiry, and audit logging. 2
Open questions
- How consistently are sponsor identities verified across different cloud providers?
- What mechanisms ensure automatic expiry and revocation of agent credentials in multi‑cloud deployments?
- Will standardized audit formats emerge to unify agent activity logs across platforms?
Watch next: A major cloud provider releases a unified audit log schema for delegated agent identities.
- Weekly update: Cloudflare OS puts agent access behind isolated apps and service-level controls update, Sep 28, 2026
- Weekly update: New tools and platform updates expand scoped identities for autonomous agents update, Sep 21, 2026
Rewritten automatically by the New Runtime knowledge desk from this record's weekly updates, releases and archive. The original text below is kept as written (Feb 5, 2026); where the two disagree, this section is newer.
Weekly knowledge desk
Weekly updates
2 reviewed updates to this shift, newest first. Every update is checked against its evidence before it changes the record.
Cloudflare OS puts agent access behind isolated apps and service-level controls
Cloudflare OS is described as replacing broad API keys and shared outputs with isolated, user-specific apps and service-level controls. This is a concrete move toward scoped agent authority, though the item says the public release is not yet evidence of production security and does not establish sponsor, expiry, or audit features.
- Cloudflare OS treats agent permissions as a product problem analysis, Oct 4, 2026
New tools and platform updates expand scoped identities for autonomous agents
Recent product releases and documentation from Mem0, Google, Cloudflare, and Microsoft demonstrate concrete implementations of scoped, auditable agent identities. Mem0’s Gateway and Google’s Gemini Credentials API provide per‑agent keys with limited tool access, while Cloudflare adds per‑Worker access roles. Microsoft’s Entra Agent ID framework details delegation, sponsorship, expiry, and audit logging for distinct agent service principals. Together these independent signals confirm and broaden the shift away from shared or borrowed credentials toward delegated, scoped identities.
Record state: stage accelerating.
- Mem0 launches Gateway to give agents scoped keys for tools signal, Sep 24, 2026
- Google upgrades Gemini managed agents with Files and Credentials APIs post, Sep 24, 2026
- Cloudflare adds per-Worker access roles for teammates and agents post, Sep 24, 2026
- Agent identities, service principals, and applications - Microsoft Entra Agent ID | Microsoft Learn external, Sep 28, 2026
- Microsoft Entra Agent ID logs | Microsoft Learn external, Sep 28, 2026
- Service account impersonation | Identity and Access Management (IAM) | Google Cloud Documentation external, Sep 28, 2026
Agents are beginning to appear as distinct actors in identity and access systems instead of borrowing a human account or disappearing behind a shared service credential. The durable boundary is becoming delegated authority: which agent acted, for whom, within which scope, and who remains accountable.
What is changing?
An agent identity can separate three things that ordinary credentials often collapse:
- the human or organization that authorizes and sponsors the work;
- the non-human actor that plans and executes it;
- the temporary authority granted for one role, task, resource, or period.
This makes model choice independent from operational accountability. The model or runtime can be replaced while permissions, consent, ownership, revocation, and audit stay attached to the same organizational principal.
Evidence
NIST’s agent identity project explicitly calls for access systems to distinguish agent and human identities, link users to agents for delegation and accountability, and record the actions and outcomes of non-human entities.
Microsoft Entra Agent ID implements a dedicated agent principal with unique identifiers, an accountable human sponsor, delegated and autonomous token modes, and agent-specific restrictions on high-risk permissions. AWS now lets MCP agents use interactive or headless OAuth while retaining IAM policies, token introspection, revocation, dynamic client registration, and CloudTrail audit events.
Cloudflare’s temporary agent accounts demonstrate the short-lived end of the same shift: an agent can receive disposable authority to deploy and verify work, after which the account is claimed by a human or expires automatically.
Counter-evidence
Workload identities, service principals, short-lived credentials, and OAuth already solve parts of this problem. Agent identity products may remain a vendor-specific relabeling of existing IAM rather than a new interoperable layer. Per-agent principals can also create identity sprawl.
Revision trigger
Revise this shift if ordinary service accounts and standard OAuth consistently provide agent-level attribution, human sponsorship, delegation mode, least-privilege scopes, expiry, revocation, and audit without agent-specific identity primitives.
September 2026 update
What changed
Scoped tool keys, multi-account gateways, and a workflow that avoids stored credentials make delegated authority concrete rather than aspirational.
Current boundary
Identity must record sponsor, scope, expiry, and revocation. A named service account without those properties is only a renamed shared key.