# AX-SYS-05: Give agents a distinct, least-privilege identity

> Access and identity · intermediate · AX-SYS-05

Issue agents their own scoped credentials, separate from human accounts, so their access can be limited, observed, and revoked independently.

## Why

Shared or over-scoped credentials are the top cause of agent data exposure. OWASP MCP01 and MCP02 together cover the two most exploited attack classes in MCP deployments: tokens with too much scope (MCP02) and tokens that are long-lived and shared across principals (MCP01). Astrix Security found 53% of MCP servers rely on long-lived static secrets, making independent revocation impossible. The MCP specification is explicit: each client-server pair should enforce its own permission boundaries with least-privilege by default.

## Do

Issue per-agent keys with minimal scopes.

## Don't

Let an agent ride a human's full session.

## Artifact

```json
{
  "principal_type": "agent",
  "agent_id": "agt_4f...",
  "owner_user_id": "usr_9a...",
  "scopes": ["orders:read"],
  "revocable": true
}
```

## Citations

1. [OWASP MCP Top 10 — MCP02: Privilege Escalation via Scope Creep](https://owasp.org/www-project-mcp-top-10/) — Temporary or loosely defined permissions within MCP servers often expand over time, granting agents excessive capabilities — the top cause of unintended data access
2. [OWASP MCP Top 10 — MCP01: Token Mismanagement](https://owasp.org/www-project-mcp-top-10/) — Shared or over-scoped credentials are the most exploited MCP risk class; agents using a human's full session token can exfiltrate data beyond their intended scope
3. [Astrix Security — State of MCP Server Security 2025](https://astrix.security/learn/blog/state-of-mcp-server-security-2025/) — 53% of MCP servers use long-lived static secrets (API keys, PATs) shared across multiple principals — making independent revocation impossible
4. [MCP Specification 2025-11-25](https://modelcontextprotocol.io/specification/2025-11-25) — MCP follows a least-privilege model; each client-server pair should have its own session enforcing clear permission boundaries

---
Source: Agent Experience Principles (axprinciples.com)