Agent Own Identity

Security Recommendation

Agents SHOULD have their own identity and SHOULD NOT use the identity of a human user. Each agent must be a distinct, identifiable entity in the system.

Rationale

Giving agents their own identity enables:

• Specific permissions: Assign permissions tailored to the agent's purpose, following least privilege
• Audit trail: Distinguish agent actions from human actions in logs and audit records
• Runtime identification: Identify which agent performed which action at runtime
• Accountability: Trace decisions and actions back to the specific agent
• Blast radius control: Limit the impact of a compromised agent to its own permissions

Using Human Identity (Anti-Pattern)