AI Agent Identity: Why Every Agent Needs Its Own Credentials (Not Your Password)

An always-on AI agent should have its own identity, separate from any person, with scoped, short-lived credentials for only the systems its job needs. It should never hold a human's password. Secrets should stay in a broker the agent calls, not in its prompt, memory or browser. This keeps the blast radius small: if the agent is manipulated by a prompt injection or simply makes a mistake, the damage is limited to its narrow role, every action is attributable to it, and revoking it does not lock out a person. In 2026, OpenAI's specialist Dots get their own identities, Meta's Muse never sees passwords, and xAI's Grok Bot keeps secrets with the human but shares one VM across all of an account's bots.

An agent is a new kind of worker. Give it the identity of one.

A non-human identity (NHI) is an account in your identity provider that represents software rather than a person. For agents it should have:

The Grok Bot row is the one to think about. Because sessions and command-line credentials persist across all bots on an account, per-bot permission is not a security boundary. Treat the whole roster as one identity.

Do not put credentials where the model can see them. Put a broker between the agent and your systems:

agent ──"call crm.update_contact(id, fields)"──▶ MCP tool server
                                                   │
                                   checks agent identity + scope
                                                   │
                                   fetches short-lived token from vault
                                                   │
                                                   ▼
                                                 CRM API

The agent only ever sees tool names and results. The MCP server holds the policy, gets a token scoped to that one call, and logs the action under the agent's identity. This is also where per-tool rate limits and spend limits belong. If you are new to MCP, read What is MCP?.

• One identity per agent, with a named human owner
• Permissions scoped to the agent's job, reviewed quarterly
• Tokens short-lived and issued per task or per call
• No human passwords, API keys or session cookies in prompts, memory or files the agent can read
• Secrets fetched by tool servers from a vault, never by the model
• Every action logged under the agent's identity, with any approver named
• One-click revocation tested before launch
• Browser sessions for computer use live in an isolated profile per agent

Should an AI agent use my password? No. Give the agent its own identity with scoped, short-lived credentials. Using your password gives it all your access, makes audit logs ambiguous and forces you to reset your own account to stop it.

What is a non-human identity? An account in your identity system that represents software, such as an AI agent or service, rather than a person. It has its own permissions, credentials and audit trail.

How do I give an AI agent least-privilege access? Create a separate identity per agent, grant only the permissions its job needs, issue short-lived tokens through a secret broker or MCP tool server, and log every action under that identity.

Do OpenAI Dots have their own identities? OpenAI's specialist Dots for businesses are provisioned with their own identities, credentials and tools for a specific role, and OpenAI says it is integrating with Microsoft's Agent 365 security controls.

Is it safe to give Grok Bot my logins? Be cautious. xAI's documentation says all bots on an account share one VM, so any login one bot uses is available to every bot on the account.

What is a secret broker? A component between the agent and your systems, such as an MCP tool server with a vault behind it. The agent only sees tool names and results; the broker checks the agent's identity and scope, fetches a short-lived token for that one call and logs the action.

Why must tokens be short-lived? A short-lived token limits what a stolen or misused credential can do and for how long, and forces access to be re-checked against the agent's current scope.

Why does a shared VM break per-agent permissions? Sessions and command-line credentials persist across everything on the VM, so any credential one agent can reach, every agent on it can reach. Treat the whole roster as a single identity.

• Enterprise AI guardrails
• How to deploy AI agents in the enterprise
• When should an AI agent ask permission?
• FDE roadmap

• OpenAI launches Dots (TechCrunch): specialist Dots and Agent 365
• Introducing Muse (Meta): credential separation
• Grok Bot: xAI's AI teammates get their own computer (Digital Applied): shared VM and secret handling