The agent identity checklist, answered line by line.
The Cloud Security Alliance Agent Identity Governance Framework gives buyers a checklist. Here is ours, including the lines where the answer is planned or not us.
Twelve questions, twelve answers.
Checklist items are paraphrased from the framework. A tick is yes, a dot is partly. Planned means not shipped.
| Our answer | How | |
|---|---|---|
| A unique identity for every agent | Yes | Every agent is enrolled with its own identity, tied to your directory. No shared accounts between agents. |
| A named human sponsor or owner for every agent | Planned | Today every agent is tied to an owning group in your directory. A named owner per agent, with a review date, is planned. |
| Business justification and periodic access review | Planned | Planned with the owner field. Today, what each agent may do is set by directory groups you already review. |
| Short-lived, scoped credentials; no standing secrets | Yes | Each job gets a badge scoped to that job and limited in time. Agents do not hold long-lived secrets to reach the services behind the door. |
| Constrained delegation enforced in infrastructure, not by policy text | Yes | The badge narrows at every handoff, and the door enforces it. A downstream agent never holds more than its caller, including across organisations. |
| A queryable record of the delegation chain | Yes | For any step, the record traces back to the person or event that started the job, and forward to every handoff after it. |
| Three linked records per action: intent declared, privilege granted, privilege exercised | Yes | What was asked for, what the badge granted after narrowing, and what the agent then did, all linked in the record. |
| Human approval for high-risk steps | Yes | Steps over a limit are sent to a human and wait. The decision is written down like any other. |
| Behavioural monitoring against declared intent | Partial | Content is inspected on the way in and out, and a guard checks untrusted prompts before they run. Fuller monitoring against declared intent is being phased in. |
| Discovery of unregistered (shadow) agents | Not us | Discovery tools do this well. Ares governs the agents you register, from any vendor, and works alongside your inventory. |
| Revocation and decommissioning, including live sessions | Yes | Decommissioning an agent revokes its badges and sessions, and it is refused at the door from then on. The revocation is on the record. |
| Identity that other organisations and registries can verify | Partial | Agents are listed in a registry that works across vendors, and the badge is honoured across organisations through Ares. Export in open credential formats is planned. |
Paraphrased from the CSA Agent Identity Governance Framework v1. Read the framework for the exact wording. Not legal advice.
Reading the answers
The lines we answer yes to are the ones the framework treats as advanced: delegation enforced by the infrastructure itself, and a record that links what was asked, what was granted and what was done. In market terms: agent identity, constrained delegation and an audit trail of the delegation chain.
The lines we answer planned or not us are just as useful to you. A named owner per agent is on our list. Shadow-agent discovery is not, and we would rather say so than stretch a feature to fit.
Take the checklist into your review.
The security pack covers the architecture, the data flows and how the record is protected, at the depth these pages leave out. We send it after a short NDA.