The Agent Access Model

The paper reframes enterprise access control from a human-centric model, where identity and device health drive decisions, to an agent-centric model that treats every task-scoped run as a separate principal. This shift acknowledges that agents act at machine speed, have fleeting lifetimes, and can compose authority across multiple hops, which breaks the assumptions of traditional single-sign-on and device posture checks. Consequently, the security stack must be re-architected to enforce least-privilege per task rather than per user.

Adopting the Agent Access Model requires building an identity brokering layer that can issue and revoke credentials on the order of minutes, as well as a mediation component that evaluates each request against a capability ceiling in real time. Engineers will need to integrate these services into existing harnesses that launch agents, modify CI/CD pipelines to request short-lived tokens, and ensure that audit logs capture the full execution graph for each task. The operational cost includes developing or procuring the broker, updating tooling to handle rapid credential turnover, and maintaining stateful trust stores that track active agent sessions.

The model does not extend to legacy service accounts or policies that rely on static, long-lived keys, because those credentials outlive the tasks they were meant to serve and can be replayed from logs or environment variables. Human-oriented anomaly detection and rate-limit mechanisms also fall short, as they react too slowly to stop an agent that can read and exfiltrate data within milliseconds. Therefore, any environment that continues to depend on durable keys or off-line risk scoring will see gaps where AAM enforcement cannot protect the workload.

For developers and operators, the practical impact is a need to embed mediation checks directly into the code paths that invoke external tools or APIs, rather than relying on perimeter firewalls or policy statements alone. Credential issuance must be tied to the task graph, ensuring that the authority granted cannot be reused beyond the intended execution window. Additionally, the system must produce a reliable audit trail that records each agent's capability ceiling and trust level, enabling post-mortem analysis and compliance verification.

The coverage of this change comes from a single source, so while the technical rationale is clear, organizations should validate the approach against their own threat models and existing tooling before fully committing to the architecture.