Services· AI governance and compliance·How do we decide better?
Taskforce · Sustain
Who signs each step in the life of an agent in your organization?
The tool already comes with agent identity. Nobody defined who signs each step.
The six life steps of every agent and every service account, each with someone who signs: creation, credential, scope, expiry, revocation and log.
Non-human identity governanceSend this page to whoever decides
Use this today, without hiring anyone
Six steps and one signature on each. Take your three agents or service accounts with the most privilege and write a person's name next to each step, not a department:
- Creation. Who approves that the agent exists, and for what.
- Credential. Who issues it, where it is stored and who knows it.
- Scope. Who sets what it can do and on which systems. And who reviews it when that changes.
- Expiry. When it lapses if nobody renews it. If it never lapses, that is the finding.
- Revocation. Who cuts it off on a Sunday, and how fast.
- Log. Who reviews what it did, how often and by what criterion.
Your identity tool already handles much of the detection. What it does not settle is who signs: the missing names are your finding. Look first for agents using a person's session, because those go through none of the six.
This sounds like you if
- The identity platform already detects the agents, and the list keeps growing with no name next to it.
- Audit asked who approved what an agent did, and the answer was not written down.
- Some assistants act with an employee's account, and everything gets recorded under that person's name.
How we solve it
The method, not the promise.
- It starts from the inventory your identity tool already produces. What the tool already does well does not get redone.
- A named person gets assigned to each of the six steps, by type of agent and account, accepted in writing.
- The expiry and revocation rules get written. A real revocation gets tested, with a window and a rollback.
- Agents acting with a person's session get found, and their own identity gets designed.
- What gets reviewed in the log, by whom and how often gets defined, in the format an auditor would ask for.
What you receive
- The six step matrix with a signed owner per type of agent and account.
- The expiry and revocation rules, tested with a real case.
- The list of agents that were acting with a person's session, with their own identity designed.
- The log review format an auditor would ask for.
The proof that applies here
- Separation of identities and access rights over an operation of more than 200,000 instances, validated in ten rehearsals before the real cutover.
- The systems separation in one of the largest bank divestitures in Latin America: 100% of systems cut over on the legal day, zero failures and zero regulatory findings.
- Eight years under regulatory supervision, where a service account with no owner is a finding.
Before you hire
The tool comes from your identity vendor and your team configures it. What gets designed here is who decides and signs at each step, and a test that revocation actually works.
The tool detects and enforces. Deciding who answers for each agent is something else: it is what had to be solved to separate two banks over two hundred thousand instances, against a contractual date.
If an agent's credential had to be revoked this Sunday, who would do it, and on whose authority?
In the cycle
If the problem is a different one
The agent no longer just answers: it executes. Nobody defined how far it can go on its own.
Agentic operation guardrails
The regulator asks why that case was rejected and nobody can reconstruct it.
Automated decision governance
I know there is AI in use and I do not know which tools or with what information.
Shadow AI inventory