Define identity types
Distinguish the human initiator, the orchestrator, each specialised agent, its workload execution environment and tool credentials.
Design delegated authorisation
A human request should not silently inherit administrator rights. Use scoped delegated grants or narrowly assigned service permissions with explicit policy enforcement.
Control lifecycle and ownership
Assign accountable owners, expiration, credential rotation, periodic certification and revocation. Record the agent’s business purpose and approved tool set.
Make every action traceable
Capture correlation identifiers from initiating user through policy decision to downstream API action. Protect logs against unauthorised alteration.
Plan for rapid containment
Revoke tokens and grants, disable tool connections and terminate sessions without depending on the agent to cooperate.
Further reading: ASD ISM September 2026 system access guidance and NIST SP 800-207 Zero Trust Architecture.