Your agents shouldn't log in as you
For the last couple of years, most teams stitched AI agents into production the fast way: by handing them human credentials. A user token here. An API key copied from someone's laptop there. A shared service account that half the team has the password to.
It's understandable. Identity is the boring part, and shipping the agent felt like the point. But that shortcut is starting to look expensive — and the industry is signalling as much. AWS rolled out a preview that gives AI agents their own identities to operate virtual desktops. It's a small announcement with a big implication: agents are becoming first-class actors, and they need to be treated like one.
Why borrowed credentials break
Reusing human credentials for agents works right up until something goes wrong. And when it does, the failure modes are nasty precisely because the agent was masquerading as a person.
- Broken audit trail. When the agent acts as a user, your logs can't distinguish human actions from automated ones. After an incident, you can't answer the first question anyone asks: who did this?
- Unbounded blast radius. A human credential typically carries broad permissions. Hand that to an agent running in a loop and a single bad decision can touch far more than the task ever required.
- Untangleable incidents. A shared service account means everyone and no one is responsible. When it's compromised or misused, there's no clean way to scope the damage or rotate access without breaking everything that depends on it.
The pattern is familiar to anyone who's cleaned up after a security incident: the convenient thing in month one becomes the unrecoverable mess in month nine.
What agents actually need
Operating agents safely at scale comes down to three things, and none of them are exotic. They're the same principles we already apply to services and humans — just applied deliberately to a new kind of actor.
Their own identity
Each agent gets an identity distinct from the humans who deploy it. That single change restores a clean audit trail: every action is attributable to a specific agent, not lost in a person's activity.
Scoped permissions tied to the task
Permissions should follow the job, not the user. An agent that summarises invoices doesn't need write access to your billing system. Scoping tightly keeps the blast radius small by design, so a misbehaving agent can only damage what its task touches.
An audit trail that survives the 3am run
Agents don't keep office hours. The logging, attribution, and alerting around them has to work when the agent runs unattended in the middle of the night — which is exactly when you'll most want to reconstruct what happened.
Treat IAM as a day-one problem
If you're building anything with agents in production, identity and access management belongs in the initial design, not a day-90 cleanup. The teams shipping reliable agentic systems aren't the ones with the smartest models — they're the ones who got the unglamorous infrastructure right before it became a crisis.
Getting that foundation right early is exactly the kind of work that pays off as you grow. We're here to help founders and teams design and build digital products that are built to scale with you, not slow you down. If you're looking to build something agentic, get in contact with us today.
The takeaway
Borrowed credentials are a loan you repay with interest, usually during an incident. Give your agents their own identity, scope their permissions to the task, and make sure the audit trail holds up at 3am. It's the boring decision that keeps your agentic systems trustworthy as they scale.