An engineer ships an agent to manufacturing. It must name an inside API, so it makes use of the important thing already sitting within the engineer’s atmosphere. The agent runs. It additionally now holds each permission that engineer holds.
That’s the default state of most agent deployments right this moment. The agent has no identification of its personal, so it borrows one. Normally it borrows a human’s, by an API key. The agent works on day one, which is strictly why the issue ships to manufacturing unnoticed.
What inheritance truly prices you
4 failures observe from that single shortcut, they usually compound.
You get privilege escalation. A non-human course of now carries a human’s full entry. It may well attain each system the human can attain, whether or not the duty wants it or not.
You get no scoping. The agent ought to contact a slender slice of your techniques. As a substitute it will get all the pieces, as a result of the important thing was by no means meant to precise “solely this.”
You get no attribution. When the agent acts, the audit log reveals the human. You can not separate what the agent did from what the particular person did. Incident response slows to a crawl, and so does any compliance story it’s a must to inform later.
You get no clear revocation. To close the agent off, you rotate the human’s key. Now you may have damaged the human’s personal entry and each different course of that trusted that key. There is no such thing as a off change for the agent alone.
A educated reader will attain for the plain fixes right here. Rotate the important thing on a schedule. Hand the agent a service account as a substitute. Each miss the actual downside.
A passport is the incorrect psychological mannequin
The intuition is to deal with identification as a passport. A passport authenticates who you might be and maps you to a hard and fast set of permissions. Present it on the border, get the entry that comes with it. That mannequin works when habits is predictable inside these permissions. A human with learn entry to a dataset reads the dataset. A service account that posts to a queue posts to the queue, on the identical cadence, each time.
Brokers break the belief beneath the passport. The proper query shouldn’t be “who is that this actor.” It’s “what is that this actor approved to do proper now, for this process.” That’s authority, not identification within the passport sense, and the distinction is the entire level.
Right here is why it issues. An agent is non-deterministic. Give two brokers the identical permissions and the identical objective, they usually can take completely different actions, as a result of every one picks its software chain at runtime primarily based on its immediate, its context, and the output of no matter referred to as it. The set of actions an agent will truly take shouldn’t be knowable while you grant its permissions.
That turns design-time least privilege right into a design-time reply to a runtime downside. You might be deciding, prematurely, what an actor might do, when the actor itself decides what to do solely as soon as it’s operating. A static grant can’t sustain with an actor whose habits shifts on each interplay.
Why your IAM stack does this to you
This isn’t a configuration mistake. It’s a structural assumption baked into identification and entry administration. The techniques you run assume an actor is considered one of two issues: an individual, or a long-lived service account with a static permission set. Each are steady. Each do roughly the identical factor on daily basis. Your controls, your audit mannequin, and your provisioning flows are all constructed on that stability.
Brokers are neither. They act on behalf of individuals, so they don’t seem to be service accounts. They’re software program that spins up and tears down by itself schedule, so they don’t seem to be individuals. They sit within the hole your IAM stack doesn’t have a class for, and the hole is the place the credential will get borrowed.
The take-away
In case your brokers authenticate because the people who deployed them, you may have a privilege-inheritance downside in manufacturing proper now. Discover it earlier than an auditor or an incident does: search for human API keys being utilized by non-human processes, and for audit logs the place you can not inform agent actions from human ones.
The shallow repair is to cease sharing keys. The actual repair is more durable. A non-deterministic actor can’t be ruled by a static, design-time grant, which suggests the agent wants an identification constructed for authority that’s determined at runtime, not a passport stamped as soon as on the border.
That raises the plain query. If the agent wants its personal identification, what’s that identification truly product of, and is it something greater than the workload identification you already run? That’s the subsequent submit.
