Who Owns the Agent’s Credentials? Identity Boundaries for Autonomous Software

TL;DR

AI agents increasingly access company systems, customer information, and financial tools, creating new security responsibilities.
Giving agents excessive permissions or shared employee credentials makes unauthorized actions harder to prevent and investigate.
Recent NIST guidance highlights the importance of distinct agent identities, limited permissions, and clear accountability.

AI agents are becoming part of everyday business operations. Companies use them to investigate transactions, analyze customer data, automate workflows, and interact with internal applications. As these systems become more capable, they also gain access to information and tools that were previously controlled by employees.

Consider a fintech company using an AI agent to investigate failed payments. The agent needs access to transaction records, customer information, and payment systems. During development, engineers might give it broad permissions to simplify integration. Everything works during testing, but those permissions could also allow the agent to modify financial records or perform actions beyond its original purpose.

This creates an important question: Who controls what an AI agent is allowed to do?

In October 2026, the US National Institute of Standards and Technology (NIST) published Design Tenets for Agent Identity Management Systems, outlining principles for managing autonomous software identities, permissions, and accountability.

The guidance addresses a growing challenge for companies introducing AI into critical systems.

Why AI Agents Need Their Own Identity

Traditional business applications identify users through employee accounts and software through service credentials. AI agents introduce additional complexity because they can independently select tools, access information, and perform multiple actions within a workflow.

For example, an employee might ask an AI assistant to prepare a financial report. If the agent uses the employee's complete account credentials, it could potentially access unrelated customer records or financial operations.

This becomes especially concerning when agents process external documents, emails, or websites containing malicious instructions.

The OWASP Top 10 for Agentic Applications identifies identity and privilege abuse as important security risks. Agents operating with excessive permissions can expose organizations to unauthorized actions, even when the original user request is legitimate.

NIST recommends treating agents as distinct identities with clearly defined ownership and access rights.

This allows companies to identify which agent performed an action, who authorized it, and whether it operated within its permitted responsibilities.

Permissions Should Depend on the Task

An agent rarely needs unrestricted access to every system involved in its work.

A payment investigation agent may need permission to read transaction histories and identify failed transfers. However, modifying payment destinations, issuing refunds, or approving transfers should require separate authorization.

Security professionals call this the principle of least privilege: giving software only the permissions necessary to complete its responsibilities.

NIST's recent guidance extends this idea through temporary authorization and zero standing privilege, where sensitive permissions are granted when needed rather than remaining permanently available.

For companies, this means designing workflows around specific actions and risk levels.

Routine information retrieval can often happen automatically, while financial transactions, changes to sensitive records, and privileged infrastructure operations may require additional approval.

These controls reduce the consequences of mistakes, compromised credentials, and malicious instructions.

Why the Agent Shouldn't Control Its Own Permissions

AI models can interpret instructions, reason about tasks, and decide which tools to use. However, their decisions can be influenced by inaccurate information or malicious content.

Imagine an agent reading a customer support ticket containing instructions that attempt to redirect it toward exporting confidential records. The agent may interpret those instructions as relevant to its task, particularly if the system lacks strong boundaries between trusted commands and external content.

This technique is known as indirect prompt injection.

The security system must independently decide whether an action is permitted, regardless of what the AI model requests.

NIST recommends separating agent reasoning from authorization enforcement. In practice, this means using established access-control systems to approve or reject operations based on explicit permissions.

An agent might determine that changing a customer's banking information would resolve a problem. The application must still verify whether that agent has permission to make the change.

This separation becomes particularly important in fintech and Web3, where an incorrect transaction or unauthorized signing operation can create immediate financial losses.

The Challenge of Multi-Agent Systems

Companies are also experimenting with workflows involving several AI agents. One agent might analyze a request, another retrieve information, and a third generate a report or initiate an action.

Each interaction creates another opportunity for permissions to spread beyond their intended limits.

If an agent delegates a task to another agent, the receiving system should only receive the access required for that specific task.

Established technologies such as OAuth 2.0 Token Exchange provide mechanisms for representing delegated authority, while newer agent frameworks continue developing their approaches.

Clear delegation rules and activity records help engineering teams understand which component performed an action and under whose authorization.

Conclusion

As AI agents gain greater responsibility, identity management becomes an essential part of software architecture.

The ability to automate a task does not automatically justify granting unrestricted access to the systems involved. Companies need clear identities, limited permissions, independent authorization, and reliable records of agent activity.

NIST's recent guidance provides a useful starting point for organizations building autonomous systems.

The next stage of AI adoption will depend partly on how effectively companies combine automation with security, operational control, and accountability.

Who We Are

Veretin Recruitment specializes in technical recruitment across Web3, AI, fintech, and blockchain infrastructure. We work closely with hiring companies to understand their technical requirements, carefully evaluate candidates, and help build reliable engineering teams.