Agentic Identity Security (Secure AI Agents)
Agentic Identity Security (Secure AI Agents)
This domain tests how to give AI agents identities, credentials, and tool permissions without treating them as trusted humans. The exam focuses on least privilege, credential brokering, human oversight, and auditability across agent workflows.
Core rules
- Every agent needs a distinct identity and an accountable human or team sponsor. Shared service accounts make attribution and revocation impossible.
- Agents should never hold long-lived secrets in prompts, memory, or model context. Use a broker to inject short-lived, narrowly scoped credentials at the moment a tool call executes.
- Authorize at the tool and action level, not just the agent level: read CRM, create draft, issue refund, send email. Scope tokens to specific resources and limits.
- Apply just-in-time elevation and human approval for high-impact actions, such as payments above a threshold or production changes.
- Log agent identity, sponsor, tool call, parameters, decision, and outcome. Detect anomalous behavior and provide a kill switch that revokes credentials and disables the agent quickly.
- Treat indirect prompt injection as a credential and data-exfiltration risk. The model's instructions are not a security boundary; policy enforcement belongs outside the model.
Worked example
A support agent can read customer records and issue refunds. Give it a dedicated identity with an OAuth token scoped to CRM read and a refund tool capped at $100. A refund above $100 triggers a just-in-time request with human approval; the broker injects a short-lived payment credential only for that call. Reasoning: the agent cannot exceed its normal limit, the elevated action is attributable to a person, and the credential is useless after the call. All tool calls are logged against the agent ID and sponsor.
Traps
- Giving several agents one shared API key.
- Relying on system prompts as the only guardrail.
- Storing secrets in conversation history or agent memory.
- Granting broad tool scopes because granular scopes are tedious.
- No owner, no review, and no revocation path for retired agents.