Non-Human Identity for AI Agents

An AI agent should not borrow a human's password and wander through your stack.

That sounds obvious. It still happens.

As agents move from demos to real workflows, identity becomes one of the most important pieces of architecture. The agent needs to act on behalf of a user, workspace, team, or service without becoming an invisible super-admin.

The identity question#

For every agent action, you should be able to answer:

• Who requested this?
• Which agent executed it?
• Which workflow allowed it?
• Which credential was used?
• What scope did it have?
• Was a human approval required?
• What did the agent actually do?

If you cannot answer those questions, the agent is not ready for production work.

Do not share user tokens blindly#

User-delegated access is useful, but it needs limits.

The agent should not inherit every permission the user has. It should receive a narrowed scope for the specific workflow step.

Example:

• User can manage billing.
• Billing agent can read invoices.
• Refund preview is allowed.
• Refund execution requires approval.
• The approval event grants one narrow action.

That is safer than handing the agent the user's full billing token.

Agent identity is not service account identity#

A service account says, "this backend can call Stripe."

An agent identity should say, "this specific workflow, on behalf of this user or workspace, can preview this billing action under these rules."

That is more precise.

The difference matters when something goes wrong.

Credential vaulting#

Keep secrets server-side.

The agent should call tools. Tools should use credentials. The model should not see raw tokens.

Use:

• Scoped tokens.
• Short-lived grants.
• Approval-bound execution.
• Tool-side redaction.
• Audit logs.
• Rotation.

The best secret handling is boring and invisible.

Identity for subagents#

Multi-agent systems make this harder.

If the planner delegates to a support agent, and that support agent delegates to a billing agent, your trace should still be readable.

Every subagent needs:

• Name.
• Role.
• Scope.
• Parent run.
• Allowed tools.
• Approval state.

Otherwise delegation becomes a place where accountability disappears.

Build it in Codelit#

Try this:

Design non-human identity for AI agents in a SaaS product. Include agent identities, delegated user scopes, credential vaulting, short-lived grants, subagent traces, approval-bound actions, and audit logs.

Design the agent identity architecture

Agents need identities because production systems need blame, trust, and rollback.