Every Agent Is a New Identity: Securing the Non-Human Workforce

Speakers

• Tracy Lee

About this session

Every production agent acts on behalf of a person, team, or business process. That makes it a new identity with credentials, permissions, tool access, data boundaries, and an accountability trail. Yet many agent deployments still rely on shared secrets and broad service accounts, making least privilege, attribution, and revocation nearly impossible. This session provides a practical security architecture for the non-human workforce. Drawing on the agent-control patterns we are implementing at This Dot, I will show how to inventory agents, establish workload identity, constrain tools and data, preserve the initiating user’s authority, record decision and action trails, and require human approval for sensitive operations. We will also examine the hard cases: agent-to-agent delegation, ephemeral workers, conflicting policy layers, and shutting down one compromised agent without stopping the business. Attendees will leave with a threat model and a staged plan for replacing shared credentials with governed agent identities.