Agent Identity & Access Management

An agent may act as a workload with its own identity or perform a narrowly delegated task for a user. Those identities are related but are not interchangeable. Inbound authentication establishes who may invoke the runtime; outbound authorization controls access to tools and services. A sound design binds credentials to their intended issuer, audience and scope and keeps secrets outside model-visible prompts. The execution layer must enforce the policy even when the model requests a forbidden operation.

Define a matrix of callers, agent workloads, tools and permitted actions. Select appropriate OAuth or workload credentials, validate incoming tokens, and obtain downstream credentials through a controlled broker. Apply resource and tenant boundaries as well as operation-level scopes. Document expiration, revocation and credential rotation. Demonstrate the design with positive and negative tests: valid delegation, wrong audience, expired credentials, cross-tenant access, missing scope and an attempted privilege increase. Preserve an audit trail that links the initiating user, agent and executed operation without logging secrets.

Authentication alone does not authorize an action. Shared static keys obscure attribution and can give every agent the same excessive authority. A human confirmation is not a substitute for token validation or resource policy, and valid credentials do not make an untrusted instruction safe. Revocation behavior depends on token lifetime and the resource server. This skill focuses on identity and delegated access; sandboxing, prompt-injection defense and data retention remain complementary controls.