Use identity platforms that treat agents as managed non-human identities — with their own distinct identity record, scoped credentials, audit trail, and lifecycle controls. Major platforms that now support this include Microsoft Entra (with workload identity federation), AWS IAM Roles for service accounts, Salesforce Agentforce, and Google Vertex AI service accounts.

The goal: give each agent deployment a verifiable, bounded identity that is distinct from any human user — so that agent actions can be attributed, audited, and controlled independently from the humans who deploy or interact with them.

The attribution gap (slide 4) exists because agents borrow human identity. Managed non-human identities close that gap. When an agent has its own identity, you can enforce least privilege on that specific identity, audit its actions independently, and revoke its access without affecting any human user account.

Every permission granted to an agent must be bound to four dimensions: subject (which specific agent, for which specific user), resource (which exact resource — not "the database," but "the orders table for this user's account"), purpose (what the permission was granted to accomplish), and duration (when the permission expires or must be revoked).

Require re-authentication when any of these dimensions changes — when a new resource is accessed, when the task purpose shifts, or when control passes to a different context. Include automated revocation on idle timeout or detected anomaly.

Directly addresses un-scoped privilege inheritance (Scenario 01 — the worker agent receives a permission bound to the query resource, not the full finance manager scope), identity sharing (Scenario 07 — the shared agent's permissions are bound to the original user's subject, not available to other users), and authorization drift (Scenario 05 — duration binding triggers revocation when the user's spending limit is reduced).