Agentic Identity Security and Identity Governance
This domain covers autonomous and semi-autonomous nonhuman identities, such as AI agents, bots, and RPA workers, plus identity governance controls that prove access is appropriate. The exam tests whether you can give an agent a distinct, owned identity with least privilege and short-lived credentials, and whether you can govern that access through certifications, entitlements, separation of duties, and lifecycle events.
Core rules
- An agent should have its own identity with an accountable owner, a documented purpose, and scoped permissions. Sharing a human account or a broad service account destroys attribution.
- Credentials for agents should be short-lived, brokered at runtime, and elevated just in time for high-risk actions. Long-lived API keys and permanent admin tokens are anti-patterns.
- High-impact agent actions should require human approval or policy gates. Log the agent identity, tool calls, delegated actions, and the human or system that authorized them.
- Agent-to-agent delegation must be explicit and bounded. An agent should not inherit all permissions of the agent that calls it.
- Identity governance includes an entitlement catalog, access certifications and reviews, role management, separation-of-duties policies, and joiner-mover-leaver lifecycle events. These controls must cover nonhuman identities, not only employees.
- Discovery and inventory are prerequisites. You cannot certify or deprovision an agent that is not registered.
Worked example
An AI agent summarizes HR cases through a SaaS API. Reasoning: register the agent as a nonhuman identity with a named business owner; issue an OAuth client with read-only scopes for the case API; use short-lived tokens; do not reuse an administrator API key; if a write action is later required, add a just-in-time elevation with approval; log prompts, tool calls, and data access; include the agent entitlement in quarterly access certification; deprovision the identity when the agent is retired.
Traps
- Treating an AI agent as an anonymous workload or as a human user.
- Granting broad scopes because the agent may need them later.
- Leaving long-lived keys in configuration or prompt context.
- Registering an agent without an owner or business purpose.
- Certifying only human access while agent entitlements accumulate.
- Assuming prompt filtering or model guardrails are an access-control boundary.