Give agents a distinct, least-privilege identity

Issue agents their own scoped credentials, separate from human accounts, so their access can be limited, observed, and revoked independently.

Why

Shared or over-scoped credentials are the top cause of agent data exposure. OWASP MCP01 and MCP02 together cover the two most exploited attack classes in MCP deployments: tokens with too much scope (MCP02) and tokens that are long-lived and shared across principals (MCP01). Astrix Security found 53% of MCP servers rely on long-lived static secrets, making independent revocation impossible. The MCP specification is explicit: each client-server pair should enforce its own permission boundaries with least-privilege by default.

Do

Issue per-agent keys with minimal scopes.

Don't

Let an agent ride a human's full session.

Artifact

{
  "principal_type": "agent",
  "agent_id": "agt_4f...",
  "owner_user_id": "usr_9a...",
  "scopes": ["orders:read"],
  "revocable": true
}