AI-Assisted Secure Coding (Appendix C) · Autonomous Agent Change Control Constraints
Scoped, non-human identities for AI
Verify that AI systems run with scoped, non-human identities (service accounts, workload identities, OIDC-issued ephemeral tokens), and that those identities cannot be used to promote their own generated artifacts across environments.
OWASP AISVS v1.01, requirement AC.8.2
In plain English
Give AI systems their own non-human identities, scoped narrowly, with short-lived credentials. Service accounts, workload identities and OIDC-issued tokens are the usual forms. Those identities must not be able to promote their own output from one environment to the next.
What good looks like
- Each AI system has a dedicated non-human identity. It does not use a person's account.
- Credentials are short-lived and issued automatically.
- Permissions are limited to the repositories and actions the system needs.
- The identity has no right to promote artifacts between environments.
How teams usually do it
- Platform app identities (for example GitHub Apps) with fine-grained permissions for bots and agents.
- Workload identity federation with OIDC for CI and agent runners, in place of stored long-lived secrets.
- A separate promotion identity, controlled by people or a different system.
Suggested evidence
- Identity configuration and permissions.
- Token lifetimes.
- A test showing the identity cannot promote.
Common mistakes
- Agents running on a developer's personal access token.
- One bot identity with organisation-wide write access.
- Long-lived tokens in agent configuration files.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.