Agent identities are the new service accounts

Описание и применение

Процесс управления сервисными аккаунтами, используемыми ИИ‑агентами, включает инвентаризацию, назначение владельцев, минимизацию привилегий, ротацию секретов и автоматическое отключение с помощью инструмента agent-off-switch.

Задача

Service accounts, especially those used by AI agents, are hard to govern: they lack owners, are not recertified, and cannot be stopped quickly, leading to potential identity and privilege abuse.

Результат

Implemented a repeatable process that inventories all non-human identities, flags ownership gaps, enforces least privilege, rotates or removes long-lived credentials, and provides an automated off-switch to stop identities safely.

Рабочий процесс

• Run aos review to inventory identities and identify findings
• Use aos off to generate an ordered runbook for disabling an identity
• Execute each change command in order, then run the verification commands
• Record time and person for each step
• Use aos drift to detect new or changed identities between inventories and review them

Доказательства

The pattern I keep seeing has three parts. Nobody owns the list. Nobody recertifies it. And when something goes wrong, nobody can stop one of these identities quickly and prove it is stopped.

Источник

An ownerless identity with a tenant-wide Graph application permission.

Источник

The off switch is aos off. It prints an ordered runbook and runs nothing.

Источник

aos review examples/demo-tenant --as-of 2026-10-09 – Agent access review As of 2026-10-09: 13 non-human identities, 11 look like agents.

Источник