Definition. Production agents need identity, not just prompts: the runtime must know which agent or workflow is acting, which permissions it has, what it is allowed to access, and when a human must approve the next step.
Model the agent as an actor
Use a distinct identity model for scheduled agents, user-delegated agents and internal service agents. This makes revocation, monitoring and incident response possible without pretending every action was a human click.
Use least privilege at the tool boundary
A useful permission model distinguishes read, propose, and execute. An agent may be allowed to inspect an order, draft a change, or execute the final mutation under separate scopes. The more consequential the action, the stronger the approval and verification requirements should be.
Preserve attribution
Every material action should retain the initiating identity, delegated authority, tool, timestamp, relevant resource, and outcome. This creates a useful audit trail for security teams and for the operators debugging an unexpected agent decision.
Design revocation and recovery first
Credentials expire. Integrations fail. Permissions change. A production system should support fast revocation, isolated failures and safe retries without leaving the operator to reconstruct state from model transcripts alone.
Further reading: NIST's 2026 analysis of AI-agent security considerations and OWASP's 2026 agentic-security guidance.
Explore the engineering capabilities that connect to this topic.