A Valid Login Is Not a Valid Decision
Agent identity is becoming infrastructure. The harder problem is governing the judgement attached to it.
News Reel - The Agent Gets Its Own Badge
The SANS Cloud Security Exchange opens later today around a problem that has moved out of the lab. Autonomous agents can authenticate, invoke tools, access cloud resources, coordinate across systems, and finish multi-step workflows before a human analyst has finished deciding whether the first alert deserves attention. The event brings AWS, Google Cloud, Microsoft, and SANS into the same conversation today, with Anthropic participating in the broader two-day summit. The vendors have different products to sell, but the problem they are describing is converging.
SANS puts the pressure plainly. Traditional cloud security assumes investigators have time to observe, triage, and respond. Agentic workloads can operate at machine speed. AWS’s session is built around detection and response fast enough to contain or remediate autonomously. Google is applying Zero Trust to agent infrastructure. Microsoft is framing agentic systems as a structural security change because they can act across identities, data stores, tools, and other agents inside environments built for human-paced decisions.
The identity layer underneath that shift is already being rebuilt. Microsoft Entra Agent ID gives autonomous agents dedicated identities and tokens instead of forcing them into ordinary user or application patterns. Microsoft blocks many high-privilege directory roles from agent identities and requires human sponsorship around agent lifecycle and access. The security premise is unusually explicit. An autonomous actor with broad administrative authority can create far-reaching consequences quickly, so identity has to carry tighter constraints and a named human accountability path.
AWS is drawing the same boundary from another direction. Its Agentic AI Lens recommends distinct agent identities, short-lived credentials, separate human and agent permissions, immediate revocation, externally enforced authorization for tool calls, and human checkpoints for high-risk mutations. It also treats agent-to-agent communication as its own trust problem. An agent can be triggered by another agent, which means identity and authority have to survive a call chain rather than a single login.
Google is pushing enforcement into that call chain. Agent Gateway can apply Identity and Access Management (IAM) policy to agent-to-agent, agent-to-tool, Model Context Protocol (MCP) server, and endpoint traffic. Its current documentation also describes semantic governance policies that can evaluate whether a tool invocation aligns with user intent and organizational constraints. In a June technical session, Anthropic and Google Cloud showed scoped agent identity, per-agent policy, tool-call guardrails, traces, and audit events as production controls for autonomous systems.
Taken separately, each of these can be dismissed as vendor architecture. Taken together, they show an industry starting to treat the agent as a first-class security principal rather than a clever application hiding behind a service account. The badge is becoming real. So is the authority behind it.
Op-Ed - The Authority Chain
There is an easy way to overstate this story. Software has been making decisions for decades. Fraud engines block transactions. Schedulers move workloads. Trading systems execute orders. Policy engines grant or deny access. Agents did not invent machine action, and pretending they did would make the argument weaker.
The break is narrower. An agent can interpret changing context, choose among tools, sequence actions, revise its plan, and continue operating under a reusable identity. The permission was granted before every future decision was known. That puts adaptive judgement behind credentials designed to answer a much older set of questions. Anthropic similarly distinguishes agents from fixed workflows by the agent’s ability to direct its own process and tool use.
Identity systems are good at asking who the principal is. Authorization systems are good at asking what that principal may access or do. Agentic systems put more pressure on the second question. What is this principal allowed to decide, and under whose authority is it making that decision?
That still belongs inside authorization in the broad sense. The difference is what has to be authorized. A valid token proves authentication. A successful policy check can prove that a requested operation fell inside a permitted boundary. Neither fact, by itself, proves that the operation still serves the purpose for which the authority was delegated, that the reasoning leading to it has not been corrupted, or that a downstream agent inherited the same limits as the one that called it.
The credential does not contain judgement. It is the handle through which judgement acquires permission.
Prompt injection makes the gap obvious. The principal can be exactly who the identity provider says it is. The token can be valid. The permissions can be legitimate. The agent can still be induced to use that legitimate authority toward a purpose nobody intended. Authentication succeeded. Authorization may have succeeded. The failure sits farther down the chain, where purpose, context, policy, and action have to remain aligned while the system is moving. Anthropic identifies prompt injection as a material risk precisely because agents can be manipulated into taking consequential actions through otherwise legitimate capabilities.
That is why external authorization matters. AWS explicitly recommends authorizing every tool invocation against policy outside the agent’s reasoning loop and stopping high-risk mutations for human review. Google is building policy enforcement into Agent Gateway so agent traffic can be evaluated before it reaches another agent or tool. Microsoft is limiting which high-privilege roles an agent identity can ever receive. These controls are different implementations of the same refusal. The agent should not be allowed to decide the limits of its own authority.
There is still a legitimate counterargument. Security vendors have a financial incentive to define a new category and sell the controls around it. Service accounts, workload identities, role-based access, policy enforcement, and machine-to-machine authentication already existed. The industry has renamed old infrastructure before and charged admission for the privilege.
That objection survives part of the way. The primitives are old. The operating cadence is not. AWS’s current guidance explicitly warns against inheriting human access-review cadences for agent identities because agent permissions can drift faster as tools, prompts, and orchestration patterns change. The old controls still matter, but their timing and evidence model have to follow the actor they are governing.
Microsoft’s sponsor model is revealing here. The company now distinguishes technical owners from business sponsors for agent identities, and it requires sponsorship for agent identity objects. Sponsors carry business accountability for purpose and lifecycle decisions rather than merely administering credentials. That is more than directory hygiene. It acknowledges that a non-human principal needs a human accountability line attached to its purpose and lifecycle. Someone has to own why the agent exists, what it is allowed to become, and when its authority should end.
Multi-agent systems make that harder. AWS already treats one agent triggering another as an ordinary architecture pattern and recommends explicit trust boundaries between agents. Google is explicitly governing agent-to-agent communication. Once agent A can invoke agent B, which can call tool C, the final action cannot be explained by the identity of the last principal alone. The receipt has to preserve where the authority began, which human or business sponsor owns it, what purpose was granted, what limits traveled with the delegation, which policy applied at each boundary, and who could have revoked the chain before the next action.
Without that lineage, perfect authentication can still produce an illegible system. The logs can tell you exactly which agent changed production and still leave you unable to answer why that agent was allowed to decide the change belonged inside its mandate.
Putting a human approval dialog in front of every tool call defeats the capability and eventually trains people to rubber-stamp prompts they can no longer evaluate. AWS’s own guidance warns against both extremes, routing everything through human review or skipping review where consequence warrants it. Human judgement belongs at consequential boundaries where risk, irreversibility, and context justify the delay. Below those boundaries, the controls have to be machine-enforceable. Per-agent identity. Bounded permissions. External authorization. Context propagation. Runtime telemetry. Decision evidence. Fast revocation. Named human accountability.
This is the control plane agents actually require. Identity establishes the actor. Authorization constrains available operations. Policy constrains context and purpose. Evidence preserves the authority path. Human accountability owns the consequence when the system still gets it wrong.
A valid login is not a valid decision.
Artifacts are cheap, judgement is scarce.
Per ignem, veritas.
Source Articles
SANS Institute, SANS brings AWS, Google Cloud, Microsoft and Anthropic together to address autonomous agents in cloud security.
SANS Institute, SANS 2026 Cloud Security Exchange, session program.
Microsoft Learn, Autonomous agent authentication and authorization flow, Microsoft Entra Agent ID.
Microsoft Learn, Agent owners, sponsors, and managers, Microsoft Entra Agent ID.
AWS Well-Architected, Agentic AI Lens, AGENTSEC03, agent identity and access.
AWS Well-Architected, Agentic AI Lens, AGENTSEC02-BP01, authorize tool invocations outside the reasoning loop.
AWS Well-Architected, Agentic AI Lens, AGENTSEC06-BP03, trust boundaries between agents.
AWS Well-Architected, Agentic AI Lens, AGENTSEC04, human oversight of agent actions.
Google Cloud, IAM overview, Gemini Enterprise agent platform and Agent Gateway.
Anthropic, Trustworthy agents in practice.
Anthropic and Google Cloud, Monitoring and securing agents at scale, technical session.