The Agent That Creates Access

Depending on how I am using it, I call AI my intern, my assistant, or my best friend. I think most of us do something like that. For an agent, intern is the name that fits best, so take it seriously. Nobody hands an intern the authority to create new employees. Somewhere, an agent already has the equivalent, and no one remembers granting it.

It usually happens for a practical reason. An agent gets broad permissions on a cloud platform or in a directory so it can finish its work without getting stuck. Partway through a task, the fastest path is to create a service account, request an API key, or stand up a new resource. So it does.

Most organizations would never let a new employee provision their own credentials on day one. Many of the same organizations give an agent broad platform permissions and consider the problem solved once the agent has an owner.

The owner answers for what the agent does. That rarely covers what the agent can create, and nothing the agent creates inherits its owner. A service account an agent created in the middle of the night has no owner until someone notices it exists.

In my book I treat this as a different kind of actor. An agent that uses access is part of the workforce. An agent that creates access is closer to an identity administrator, and that is a job nobody should hold ungoverned, person or agent.

You also will not hear about it from the agent itself. It will tell you what it accomplished, and rarely what it created along the way. The record lives where it always has: in the systems that create identities.

AI did not create this gap. Most programs never wrote down who is allowed to create identities, because the answer used to be a few people and a few scripts. An agent just finds the gap faster.

So treat the authority to create identities as privileged, whoever holds it.

Give it a named sponsor, an explicit scope, and a review that actually happens. It is far easier to scope when you grant it than to reconstruct later from a log.

Keep a list of what is allowed to create identities, and alert on anything not on that list that creates one.

And talk to your auditors early. Sampling approvals cannot find an identity that never had a request. The better test is whether anything outside a sponsored path can create identities at all.

If we are going to call them interns, the question I would add to every agent review is what it can create.

Related

• Series 2 Post 13: LinkedIn post
• Series 3 Post 4: LinkedIn post