Agent credentials
Agents are first-class principals. They receive scoped, short-lived credentials — never ambient org-admin by default.
Issuance loop
- Agent authenticates (SVIDs / OIDC device flows as applicable).
- Declares needed capabilities for the task.
- Policy allow / deny / require-approval.
- Broker issues time-boxed token/scopes.
- Audit refs only in the log.
Rules
| Rule | Detail |
|---|---|
| Least privilege | Scope to tools + resources needed |
| Short TTL | Rotate; no long-lived agent PATs as default |
| No plaintext in context | Schema-only views and fixtures for secrets |
| Spend caps | Policy breakers on runaway tool use |
| MCP auth | Same policy plane as CLI |
Related
Agents overview · MCP · Identity · Audit