Control agent access
Why every AI agent needs its own identity
Most agents run on someone's personal API key. That makes the agent invisible in the logs, and you can't switch it off without locking the person out too.
New to MCP? What is an MCP server? covers the basics first.
Security teams call anything that logs in without a person a non-human identity, such as a service account or a CI pipeline. An AI agent with a credential is one of these. The difference is how it shows up. Nobody files a ticket to create a service account for the triage agent. Someone adds a GitHub MCP server to their AI app, pastes in their own personal access token to get it working, and the agent is live under their name.
What goes wrong with a borrowed key
Take that triage agent. It's supposed to label issues and close duplicates, but it's running on a token that can also merge to main.
It can merge, because the token can, and the GitHub server lists merge_pull_request right next to list_issues. MCP permissions explains why a server connection gives you every tool by default.
GitHub's logs show the person, not the agent. If the agent mislabels a hundred issues overnight, or a prompt injection in an issue body talks it into something worse, the record says the person did it.
To stop the agent you revoke the token, which also logs the person out of every other tool using it. So teams either leave a misbehaving agent running or break something to turn it off.
Nothing was stolen in any of this. The agent did what it was set up to do, under the wrong name.
What OWASP says
The OWASP Non-Human Identities Top 10 (2025) has several entries that fit this exactly. NHI10, Human Use of NHI, describes "lack of auditing and accountability due to indistinguishable activity between humans and automation." NHI7, Long-Lived Secrets, covers personal tokens that stay valid for months. NHI5, Overprivileged NHI, is the agent inheriting every scope the person's token has.
Giving the agent its own
- Create a credential just for the agent, either a service account on the API or an identity on a gateway in front of it. It never shares a token with a person.
- Use short-lived tokens. A token that expires in minutes isn't much use to whoever copies it, and revoking the agent doesn't mean rotating anyone else's key.
- Give it an owner and a review date, the same as any account that can act in production.
- Grant it only what the task needs. Triage doesn't need
merge_pull_request, even when the server bundles it. Least privilege for AI agents goes further.
With that in place, every log line names the agent, and you can suspend it without touching anyone else.
An identity tells you who acted and lets you stop them. Whether they should have been allowed to act in the first place is a permissions question, so you need both.
In Statio
Each agent is its own identity, with its own grants, tokens that last five minutes, and a status of active, suspended, revoked or expired. The activity log names the agent on every call, and suspending one agent leaves everyone else's access alone. Any gateway or identity provider that gives agents their own principal gets you the same audit and revocation benefits. The MCP security checklist shows where your setup stands.
For where the credential itself should live, see keeping API keys out of your agent's reach.