Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Agent and Orchestrator Identity
Give each agent its own identity
Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.
OWASP AISVS v1.01, requirement 9.4.1
In plain English
Give each agent instance its own cryptographic identity, and have it authenticate to other systems as itself. Downstream systems can then apply rules to that agent, and your logs can say which agent did what.
What good looks like
- Each agent instance has a unique identity backed by a key or certificate.
- The agent authenticates to downstream systems with that identity. It does not borrow a shared service account or a user's password.
- Downstream logs record which agent instance made each call.
- One agent's identity can be revoked without affecting others.
How teams usually do it
- Workload identity from your platform: cloud workload identities, Kubernetes service accounts with bound tokens, or SPIFFE/SPIRE identities.
- Agent identity features in your identity provider, where it offers them, to register agents as their own kind of principal.
- Short-lived certificates or tokens issued per instance at start-up.
Suggested evidence
- Identity configuration.
- Sample downstream logs showing distinct agent identities.
- A revocation test.
Common mistakes
- Every agent sharing one service account.
- Agents acting with a developer's personal access token.
- Identity per agent type but not per instance, so you cannot tell which run misbehaved.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.