An agent is neither an ordinary user nor a conventional service account. It may act for different users, delegate work to other agents and choose among tools at runtime. If identity and authority are not modelled explicitly, permissions expand silently through the chain and audit records no longer explain who was responsible for an action.
This course applies established identity principles to agentic systems. Participants will distinguish the user, agent, workload, tool and approving authority; design scoped delegation; and ensure that high-impact actions require fresh evidence and appropriate approval. Model instructions can request access, but deterministic identity infrastructure decides whether access is granted.
The course concentrates on architecture and implementable patterns rather than any single IAM vendor.
Learning Outcomes
Upon completion of this course, participants will be able to:
- Model users, agents, workloads, tools and services as distinct principals
- Choose appropriate identity patterns for short- and long-running agents
- Propagate user authority without granting an agent ambient privilege
- Design fine-grained permissions and constrained delegation chains
- Apply short-lived credentials and step-up authorisation
- Secure identity across MCP and agent-to-agent interactions
- Record attributable, reconstructable agent actions
- Govern the lifecycle of non-human identities at enterprise scale
Course Outline
Identity Problems in Agentic Systems
- Users, agents, models, runtimes, tools and downstream services
- Acting as a user versus acting as an independent workload
- Ambient authority and the confused-deputy problem
- Permission expansion across delegation chains
- Identity requirements for autonomous and scheduled work
- Establishing accountability for machine-initiated actions
Modelling Agent Principals
- Distinct identities for agent definitions and running instances
- Workload identity and attestation
- Session, task and transaction identities
- Binding an agent instance to approved code and configuration
- Representing human sponsors and business owners
- Inventory and ownership of non-human identities
Authentication Patterns
- Service authentication and workload federation
- OAuth 2.0 and OpenID Connect roles in agent systems
- Token exchange and on-behalf-of flows
- Mutual authentication between agents and tools
- Protecting against token replay and credential substitution
- Re-authentication for long-running and resumed tasks
Fine-Grained Authorisation
- Role-, attribute- and policy-based access control
- Scoping by tool, resource, operation and parameter
- Separating read, propose, approve and execute permissions
- Contextual policy using user, task, risk and environment
- Deny-by-default and explicit capability grants
- Keeping enforcement outside probabilistic model behaviour
Delegated Authority
- Expressing what an agent may do on a user’s behalf
- Constraining purpose, duration, resources and onward delegation
- Capability and token-based delegation patterns
- Preventing privilege amplification through agent chains
- Revocation and expiry during long-running work
- Handling delegation across organisational boundaries
Step-Up Approval and Separation of Duties
- Triggering stronger controls as risk changes
- Human approval for financial, destructive and external actions
- Independent approvers and dual-control patterns
- Binding approval to exact parameters and evidence
- Preventing post-approval substitution by an agent
- Designing useful approvals without creating fatigue
Identity in MCP and A2A
- User and agent identity at MCP client and server boundaries
- Resource indicators, scopes and remote server trust
- Agent Cards and declared authentication schemes in A2A
- Propagating authority across agent-to-agent tasks
- Cross-agent audit correlation and trace context
- Handling third-party agents and tools safely
Credential and Secret Management
- Short-lived tokens instead of embedded credentials
- Just-in-time access and dynamic secret delivery
- Isolation of credentials by task and environment
- Preventing secrets from entering prompts, memory and logs
- Rotation, revocation and emergency suspension
- Testing authorisation independently from model decisions
Audit, Monitoring and Lifecycle Governance
- Recording principal, delegator, policy decision and side effect
- Detecting anomalous access and unusual delegation patterns
- Joining identity events with agent execution traces
- Provisioning, review and decommissioning of agent identities
- Responding to compromised agents or integrations
- Evidence for risk, compliance and internal assurance
Practical Capstone
- Model identities for a multi-agent enterprise workflow
- Implement on-behalf-of access with constrained delegation
- Add parameter-level policy and short-lived credentials
- Require step-up approval for a consequential action
- Trace the complete authority chain through MCP or A2A
- Demonstrate revocation, audit and incident containment
Intended audience
This course is designed for identity and access architects, security engineers, AI platform engineers, solution architects and technical risk professionals responsible for agents that access enterprise data or take actions on behalf of users. It is especially relevant to zero-trust and regulated environments.
Prerequisites
Those attending this course should meet the following:
- Strong understanding of authentication and access-control concepts
- Familiarity with OAuth 2.0, OpenID Connect or enterprise IAM
- Basic understanding of AI agents, tool calling and MCP or A2A
- Experience reviewing distributed-system or API security architectures