WEEK 39 · IDENTITY

Give one agent an identity of its own.

Every agent in your environment borrowed its authority from something else, and nobody wrote down how much of it came along.

Submitted by Neil Watkins · MondayMove

May 15, 2026

Somebody in your environment authorized an agent to act on its own and cannot tell you what they authorized.

The model sits in the middle of a lot of wiring. Data flows in from sources somebody connected. Tool calls flow out to systems somebody authorized. Almost nobody has drawn that wiring, and the interesting risk lives inside it.

No one asks. They just do.

Part of why: the wiring got built by different people at different times. A platform engineer connected the data source. An application owner switched on the tool integrations because the demo required them, a vendor shipped a default nobody changed, and not one of those three people thought they were making a security decision. No single person holds the whole picture, and the architecture diagram, if one exists at all, shows boxes rather than authority.

Three questions collapse that ambiguity fast.

Which identity does the agent use. What data can it read. What can it do with no human in the loop. Insist on written answers, because a conversation lets people gloss the parts they are still guessing.

The second one surprises people. Agents get pointed at a data source through a connector that authenticates once, broadly, and then serves every query the agent makes after that. The scope of the connector is the scope of the agent. Go look at the app registration behind your copilot and count the permissions sitting on it, and notice that Files.Read.All got granted during a proof of concept by somebody optimizing for a working demo.

Model evaluation is the least useful AI security work most teams are doing right now. It gets the attention because it looks like AI, it has benchmarks, and there are vendors selling tooling for it. The authority question reads like plumbing by comparison, which is exactly why it goes unanswered quarter after quarter.

Think about what an incident review actually requires. Nobody asks for the model card. Somebody has to reconstruct what the agent could reach and what it was permitted to do, and when that reconstruction starts during the incident, day one goes to archaeology instead of containment.

Here is where writing it down stops being paperwork. Those three answers are the scope. Take them to whoever issues credentials in your environment and ask for one that fits them: an identifier belonging to that agent and nothing else, a named human who answers for it, permissions granted deliberately rather than inherited, and a date or a condition that retires it.

Expect the shared credential to fight you. The one your agent borrowed is usually holding up two other things nobody documented either, so revoking it to scope one agent breaks the other two on a Tuesday afternoon. That is not a reason to skip the step. That is the finding.

Identity programs spent fifteen years building lifecycle for people. Joiner, mover, leaver, quarterly attestation, a manager whose signature carries weight. Every piece of that machinery assumes a human being with a start date, and none of it engages with something a Terraform module provisioned at four on a Thursday afternoon.

So, here's the MondayMove

Pick the agent in your environment with the most access. Write down which identity it uses, what data it can read, and what it can do with no human approval, then give it a credential of its own that matches those three answers and nothing more.

One agent done properly teaches you the pattern for the thousand (literally) behind it.

Friday Follow-Up

Question three is where people stop.

No responses in yet, so here is where I expect this one to break, and the first question is the only one that takes ten minutes.

Submitted by Neil Watkins

September 25, 2026

MondayMove gives you one concrete action every Monday. FridayFollowUp closes the loop.

Each Friday, a short dispatch on what practitioners actually found when they ran the week's move: where they got stuck, what surprised them, and what to do next. Not sanitized case studies. Field notes. Practitioner to practitioner.

Nobody asks before they wire one of these up, so this week's move is the asking, done late.

Nothing has come in yet, so this week runs as predictions. Here is where I expect it to break, plainly enough that you can tell me Monday how wrong I was.

Question one takes ten minutes. Somebody knows which account the agent authenticates as, or the console will tell you in two clicks, and it lands fast enough to make everybody feel good about the next two.

Question two takes a week, and the reason is structural. The scope of the connector is not visible from where the agent runs. You have to go to whoever owns the platform, and they will ask why you want to know, and that conversation is the actual work. I expect a lot of people to stall there and call it done with an answer describing what the agent uses rather than what it can reach.

Question three stops people. My guess is that "with no human approval" turns out to cover almost everything the agent does, because approval got designed around the output rather than around everything the agent does to produce one. Nobody thinks of it that way until it is written down.

Then the credential turns the hour into a month. The account is shared, two other things depend on it, and scoping one agent becomes a migration with a change window. Budget for that now.

My other guess is that question one produces a person's name. Plenty of these harnesses authenticate as whoever is sitting in the chair, so the identity is a human being and the entitlements were granted years ago for reasons unrelated to any agent. If that is your answer, the move still worked. You found something bigger than what you set out to check.

Where I expect this to break earliest is the vendor copilot that authenticates as the whole tenant, because there is no per agent credential to issue. That is not the move failing. Write down that the scope is the tenant and put the vendor's name on it.

Take the answer to question three and show it to whoever asked for the agent in the first place, read it to them exactly as written, and ask whether that is what they thought they were approving. I expect it to move faster than any control you ship this quarter.

The FOMO is real and it is not an excuse.

Keep going. See what a week can do.

No correct answers here. This is practitioner-to-practitioner. The more honest the responses, the more useful this gets for everyone reading on Monday morning.

See you then.

Discussion