Agent Identity and Access Governance Controls

Procurement and grants agents often inherit staff credentials or use shared service accounts. When an agent acts, agencies cannot attribute the action, limit access to the specific task, or revoke one agent without disrupting others. PointGuard AI issues each agent a cryptographic identity and scoped, delegated access aligned with zero-trust principles.

Shared credentials make agent actions anonymous and access hard to limit.

• Agents run under staff accounts or shared service identities.
• Long-lived credentials sit in configs and scripts.
• Audit logs cannot separate agent actions from human ones.
• Revoking a compromised agent disrupts shared accounts.

Agent Identity & Access Security assigns verifiable identities and enforces scoped, delegated access.

1. Register every agent. Assign each agent a DID-based identity backed by Ed25519 keys, with an owner and defined mission.

2. Delegate with context. Use On-Behalf-Of tokens so actions carry both the agent's and the staff member's identity.

3. Scope and broker access. Issue short-lived OAuth 2.0 tokens limited to the task, and broker secrets through enterprise vaults.

4. Attribute and revoke. Tie every action to an agent identity and revoke any single agent instantly.

• OWASP Top 10 for LLMs: LLM06 Excessive Agency, addressing agents holding broad, standing access to agency systems.
• OWASP Top 10 for Agentic Applications: ASI03 Identity and Privilege Abuse and ASI07 Insecure Inter-Agent Communication, covering credential and privilege abuse and unverified communication between agents.
• NIST AI RMF: GOVERN assigns ownership; MAP identifies agent identities; MEASURE tracks credential risk; MANAGE enables revocation.