Agent and Machine Identity Provisioning (Delivery)

Agent and Machine Identity Provisioning (Delivery)

1. 01

   Enumerate every non-human identity the engagement will create before writing any access rule

   List service accounts, CI/CD tokens, webhook signers, and AI agent credentials by name and owning system. A delivery that starts with unnamed machine identities ends with orphaned keys nobody can attribute to a client.

2. 02

   Assign each identity a named human owner and a maximum credential lifetime

   Default to 90 days for long-lived service accounts and 24 hours for agent session tokens. Okta and JumpCloud both support lifecycle policies that expire credentials automatically, which removes the renewal conversation from the account manager's plate.

3. 03

   Scope permissions to the narrowest resource set the workflow actually touches

   Grant read-only where the agent only reads, and separate write scopes per environment. Permit.io and WorkOS expose policy layers that let you express this without hand-editing role tables per client.

4. 04

   Route secrets through a vault rather than environment variables or shared documents

   Bitwarden Secrets Manager and 1Password both issue machine credentials that rotate without a redeploy. Plaintext .env files in a client repo are the single most common finding in post-incident reviews.

5. 05

   Log every agent and service-account action to a destination the client can query

   Ship auth events to the client's SIEM or a retained log store with at least 90 days of history. When an agent misbehaves, the first client question is what it touched, and a log you cannot produce becomes a credibility problem.

6. 06

   Run an access review at the 30-day mark and revoke anything unused

   Zluri and Securden automate this by flagging dormant entitlements across SaaS and cloud. Unused credentials are the cheapest breach vector to close and the easiest to justify on a retainer invoice.

7. 07

   Document the revocation path in the client handoff pack before go-live

   Write down who can kill each credential, how fast, and what breaks when they do. Offboarding a contractor or an agent should take minutes, not a support ticket to the vendor.