XIV · Anti-PatternsAnti-pattern✕

Agent Identity Sprawl

also known as Non-Human Identity Sprawl, NHI Sprawl

Anti-pattern: an agent fleet mints non-human identities at machine speed while scoping, rotation, ownership, and revocation stay human-speed, so over-privileged long-lived credentials accumulate, outlive their agents, and widen an ungovernable attack surface.

Context

An organisation scales from a few agents to a fleet. Each agent, sub-agent, and tool integration needs an identity and credentials to act — a service account, an API key, an OAuth token. Provisioning these is automated and instant; governing them — scoping least privilege, rotating secrets, tracking ownership, revoking on retirement — still runs through human-speed review.

Problem

Identity creation happens at machine speed and identity governance happens at human speed, and the gap compounds. Over-broad, long-lived credentials are minted faster than anyone scopes, rotates, or retires them; tokens outlive the agents they were issued for; ownership of a given credential becomes unknown. The attack surface grows week over week because nothing reconciles created identities against active, owned, and least-privileged ones, and no human-speed approval process can keep pace with the rate of creation. The result is a population of orphaned, over-privileged non-human identities that no one is tracking and no one can confidently revoke.

Forces

  • Agents need identities to act, and provisioning is automated, so creation is effectively unbounded.
  • Scoping, rotation, ownership, and revocation are governance work that stays human-speed.
  • Least-privilege scoping per agent is slower than issuing a broad credential that just works.
  • The creation-versus-revocation rate mismatch means the orphaned-credential population only grows.

Example

A platform team scales from a handful of agents to hundreds, each spinning up service accounts and API keys on demand. Provisioning is instant; nobody is scoping or retiring the credentials, which are broad and long-lived. A quarterly audit finds thousands of tokens, many tied to agents that no longer exist and owned by no one, any of which would grant an attacker standing access. The team moves identity issuance to short-lived least-privilege credentials bound to an owning agent and revoked on retirement, and adds continuous reconciliation — so governance finally runs at the speed identities are created.

Diagram

Solution

Therefore:

Make identity lifecycle keep pace with identity creation. Issue short-lived, least-privilege credentials by default rather than broad long-lived ones; bind every identity to an owning agent and a retirement trigger so it is revoked when the agent is decommissioned; continuously reconcile created identities against active, owned, scoped ones and flag orphans. The mechanism to fix is the creation-versus-revocation rate mismatch, so the controls must themselves run at machine speed. Mitigation patterns: agent-credential-vault for scoped, rotated, brokered secrets per agent; delegated-agent-authorization for narrowly scoped, time-bound grants. This is the fleet-scale lifecycle failure those per-agent patterns do not by themselves prevent.

What this pattern forbids. No useful constraint; the missing constraint is machine-speed identity governance — least-privilege scoping, rotation, ownership, and revocation that keep pace with the rate at which agents mint identities.

The patterns that counter or replace it —

  • alternative-toAgent Credential Vault★— Broker the agent's credentials at action time through a managed vault of passwords, MFA secrets, and digital personas, so secrets never enter the prompt or context and the agent authenticates as a governed identity.
  • complementsAgent Privilege Escalation✕— Anti-pattern: let an agent's effective permissions be the union of its own identity, the identities of its tools, and the identities of the services those tools call.
  • complementsShadow AI✕— Anti-pattern: leave the corporate LLM offering so restrictive, slow, or narrow that employees bypass it with personal accounts and unapproved agent tools, creating data leakage and ungoverned tool calls that security cannot see.
  • complementsAgent Sprawl✕— Anti-pattern: every team ships its own agents while ownership, success metrics, monitoring, and a decommissioning path stay an afterthought, so the fleet outgrows governance and most agents end up unwatched, unowned, and impossible to retire.
  • complementsStatic Role for a Dynamic Agent✕— Anti-pattern: authorize a goal-driven agent with static, login-time, role-based privileges, so its standing permissions persist between and beyond tasks, forcing a choice between over-granting broad access and blocking the agent mid-task.
  • conflicts-withEphemeral Agent Identity★— Mint each agent run a short-lived identity of its own, scoped to one task and provisioned just-in-time, then revoke it on completion so no standing credential outlives the work.
  • complementsAgent-Speed Incident-Response Gap✕— Anti-pattern: govern an autonomous agent with incident-response and breach-reporting frameworks scaled to human reaction time, even though a compromised agent can exfiltrate data and erase its traces in seconds.

Neighbourhood

Click any neighbour to follow the language. Scroll to zoom, drag to pan.

References

Provenance