Security

Agent Identity and Access

• A Presenter Identity for the Caller
• Choosing an Identity Provider for a Small Team Using AI Agents
• Contractor Scopes That Expire on Their Own
• How to Offboard a Contractor Who Had Agent Access
• Naming and Tagging Service Accounts So You Can Find Their Owner
• Propagating the Caller's Identity Through Agent Chains
• Separating the Agent's Credentials From the Caller's Identity
• Testing an Agent Fails Closed Without Its Group Claim
• Testing Group Claim Size Limits Before an Agent Owns Too Many
• Testing Your SSO Before Agents Depend on It
• A Naming Convention for the Tools and Scopes an Agent Holds
• A Pre-Flight Checklist for Any Agent That Signs In Through SSO
• A Rollback Plan for an Agent That Lost a Group It Depended On
• A Token Exchange Client You Can Test
• Audit Log Fields That Prove Which Identity Acted
• Binding a Tool Call to the Caller Who Asked for It
• Choosing Token TTLs for Agents That Run Unattended
• Clock Skew Between IdP and Agent Hosts: A Test and Tolerance
• Designing a Fallback API Key Model for Agent Tools
• Expiring Agent Credentials Without Breaking Scheduled Jobs
• How to Document the Identity Chain for an Agent
• How to Test That an Agent Fails Closed on Expired Credentials
• How to Write a Playbook for a Compromised Agent Credential
• IdP Groups That Map to Agent Permissions
• Managing Break-Glass Accounts for Agent Access
• Monitoring the Size and Shape of Group Claims in Production
• Revoking a Presenter Credential Without Breaking Scheduled Jobs
• Revoking an Agent's Access Without Breaking Its Running Jobs
• Scoping an Admin Role for an Agent Without IdP Superuser
• Service Accounts for Agents: Naming, Ownership and Expiry
• What an Agent's Identity Looks Like in Access Logs
• What the Presenter Identity Must Not Inherit From the Caller
• What Your Agent's Group Membership Says About Permissions
• When a Credential Outlives Its Expiry: A Recovery Playbook
• When an Agent's Credential Expires Mid-Call: Failing Closed
• When an Agent's Group Claim Is Too Large: Short Alternatives
• When Your SSO Is Down: A Grace Period Policy