The fastest way to get an agent working is to give it an admin API key. It's also the fastest way to fail a security review. Integration done properly starts with identity.
Three identity patterns
- Agent as a workload identity: an IAM role or service principal per agent, with short-lived credentials. Good for back-end automation.
- Agent acting for a user: the agent carries the user's delegated, narrowed permissions, so it can never see more than the person who asked.
- Agent as a directory identity: managed in your identity provider (for example Okta) with the same lifecycle, policies and access reviews as people.
What to log
- Which agent acted, and on whose behalf.
- Which tool it called, with which parameters.
- What came back, and what the agent did next.
- Who approved it, where approval was required.
Revocation is the real test
If you can't switch an agent off in one place, in minutes, without breaking anything else, the integration isn't finished. Design the off switch before the first deployment.