An Agent Passport is the identity record that makes an autonomous agent's actions attributable to a named human owner.
It carries a cryptographic identity, an accountable person, a declared mission, an explicit permission set, an autonomy level and a lifecycle state. Without one, an agent's actions belong to a shared credential rather than to anyone in particular — and no amount of logging afterwards can repair that.
Get an Agent Trust Gap BriefAn agent without an identity is an action you cannot attribute
Machine identities already outnumber human ones by a wide margin in most enterprises — CyberArk puts the ratio above 80 to 1. Agents make that worse, because they act on their own initiative rather than executing a fixed script. If the only thing behind an action is a shared API key, then "who did this" has no answer.
Cryptographic identity
Not a string in a config file. An identity that can be presented, verified and revoked independently of the process holding it.
A named human owner
Every agent has one accountable person. Not a team, not a mailbox. When something goes wrong, there is no ambiguity about whose decision it was to run it.
A declared mission
What this agent exists to do, in one sentence, machine-readable. Scope is enforced against the mission, not against a vague trust level.
Explicit tool permissions
The tools it may invoke, and the tools it is explicitly denied — because "not mentioned" and "forbidden" must never be the same state.
An autonomy level
Human-led, human-assisted, or bounded-autonomous. Written down, not inferred from how the agent has behaved so far.
A lifecycle state
Issued, active, suspended, revoked, retired. Agents get created constantly and decommissioned almost never; the state is what makes cleanup possible.
Synthetic sample sample-agent-passport.json — the full structure, labelled, not a production record.
Discovery: the agents you do not know you are running
Almost every agent trust assessment produces the same first finding, and it is never the one the team expects: there are more agents than the inventory says, and some have no owner at all. Sprawl happens because creating an agent is a five-minute task and decommissioning one is nobody's job.
- Shadow agents — running in production, never inventoried, no accountable owner.
- Orphaned credentials — the agent is gone, its token still works.
- Over-scoped permissions — granted for a pilot two quarters ago and never narrowed.
- Shared identity — several agents behind one credential, so attribution is impossible by construction.
- Hardcoded secrets — keys in source, in prompts, in tool configs.
- No joiner-mover-leaver process — the human lifecycle exists; the agent lifecycle does not.
Delegation without impersonation
The hard part of agent identity is not proving who the agent is. It is representing that an agent is acting on behalf of a person, with that person's authority, without becoming indistinguishable from them.
Done properly, an action carries both identities — the agent that executed and the human whose authority it borrowed — along with the scope of what was delegated and when that delegation expires. Done badly, the agent simply holds the user's token, and every log line says the human did it. The second pattern is common, and it destroys attribution at exactly the moment you need it most.
Standards-side this maps to token exchange and audience-bound credentials rather than credential sharing; on the workload side, to federated workload identity instead of long-lived static secrets.
Where this lands in the standards
| Framework | Mapping |
|---|---|
| OWASP Agentic 2026 | ASI03 Identity & Privilege Abuse — the direct hit. Also ASI10 Rogue Agents, since an unidentified agent cannot be recognised as rogue. |
| NIST AI RMF | GOVERN 2.1 — roles, responsibilities and lines of accountability. |
| ISO/IEC 42001 | A.9.2 — roles, responsibilities and authorities within the AI management system. |
| EU AI Act | Art. 26 — deployer obligations, including assigning human oversight to named natural persons. |
Mappings are ApexClaw's interpretation, published so they can be checked. Last verified 2026-08-06. Not legal advice. Full crosswalk →
Common questions
What is an agent passport?
A record of the agent's identity, its owner, the action classes it may perform and the window in which that is valid. It is what a policy layer checks before permitting an action.
Why not use a service account?
Service accounts assume predictable call patterns. Agents make unpredictable calls at machine speed, which leads to over-scoped credentials — the worst combination with unpredictable behaviour.
How long should agent credentials live?
Short enough that natural expiry is an acceptable worst-case revocation window. That converts revocation from an assurance into a measurable number.
Can two agents share an identity?
They should not. Shared identity makes actions unattributable and prevents revoking one agent without breaking the other.
Who owns an agent identity?
A named human, recorded, and reviewed when people change roles. An identity with no owner is the definition of a rogue agent waiting to happen.
Machine identities already outnumber human ones by more than eighty to one. Treating agents as anything other than first-class identities is how governance falls behind on day one.
Sources
Machine identities already outnumber human ones by more than 80x in most enterprises, the same ratio cited on the platform overview from Gartner's agentic-AI research, which separately projects that more than 40% of agentic AI projects will be cancelled by the end of 2027 — unowned, unattributable agent identity is a large part of why. Enforcement exposure is real too: the EU AI Act's three penalty tiers run up to 7%, 3% and 1% of global turnover, per the EU AI Act itself. Standards this surface maps to:
- Non-human identity and credential abuse: OWASP Top 10 for Agentic Applications.
- Governance and accountability for autonomous systems: NIST AI RMF.
- Identity and access management practice generally: ISO/IEC 42001.