Agent Identity & Access Terms

§01 / TERMSin this hub: 28

Terms

Every term in this hub.

This hub collects the identity and access terms in the Prefactor glossary. The identity group covers the core concepts: unique agent identity, non-human identity, and agent passports, the mechanisms that give each agent a name that survives across systems. Attribution starts here; everything else in this hub assumes it.

The credentials group covers what agents carry: access tokens, API keys, and client secrets, along with the trade-offs between static secrets that are easy to use and short-lived credentials that are easy to revoke. The access control group covers what those credentials unlock: scoped access, least privilege, and the role and attribute models that decide it.

The trust group deserves a specific mention: trust chains and trust boundaries are how a final agent action traces back to its original human or organisational authorisation, across every delegation in between. They are the difference between an audit trail that answers questions and one that raises them.

A scope note in the interest of honesty: several classical authentication terms in this cluster are deliberately kept as subject-matter definitions only. This glossary defines OAuth because agents use it, not because identity infrastructure is the product; the entries say what each term is and stop there.

Identity

Agent Passport An agent passport is a portable package of identity and trust information for an agent, such as identifiers, credentials, or attestations. Claims-Based Identity Claims-based identity is an authentication model in which an identity provider issues a token containing assertions (claims) about the subject, such as its name, role, group membership, or custom attributes. Machine Identity A machine identity is a cryptographically verifiable credential, such as an X.509 certificate, a public/private key pair, or a platform-attested token, that proves the identity of a non-human entity such as an AI agent, a container, or a VM. Non-Human Identity (NHI) Any digital identity that is not a human user, including AI agents, service accounts, API keys, bots, scripts, and automated workflows. SCIM (System for Cross-domain Identity Management) An open standard protocol for automating the provisioning and de-provisioning of user identities across systems. SPIFFE (Secure Production Identity Framework for Everyone) SPIFFE is an open standard for assigning cryptographic identities to workloads in dynamic infrastructure environments. Unique Agent Identity A unique agent identity is a stable identifier that distinguishes one agent from every other agent or service. Workload Identity A workload identity is a cryptographically verifiable identity assigned to a software workload, such as an AI agent, container, or serverless function, that proves what the workload is rather than relying on network location or static secrets.

Credentials & tokens

Access Token An access token is a credential an application or agent uses to call a protected API. Client Secret (M2M) A client secret is a confidential value used with a client ID to authenticate a machine client during OAuth flows such as client credentials.

Access control

Role-Based Access Control (RBAC) for Agents RBAC for agents grants permissions based on assigned roles rather than on individual rules per request.

Authentication

Machine-to-Machine (M2M) Authentication Machine-to-machine authentication is how one service or agent proves its identity to another without a human login. OAuth 2.0 (Open Authorization 2.0) An industry-standard protocol for authorization that allows a third-party application to obtain limited access to a user's protected resources on an HTTP service, without exposing the user's long-term credentials. Single Sign-On (SSO) An authentication method that allows users to log in once and gain access to multiple related applications without re-authenticating.

Trust

Trust Boundary A trust boundary is a line in a system architecture where the level of implicit trust changes: the boundary between an agent's internal reasoning context and an external tool, between one organisational tenant and another, or between a low-trust public network and a high-trust internal network. Trust Chain A trust chain in an agent system is the sequence of verified identity relationships that links a final agent action back to its original authorisation source, typically a human user or an organisational policy.

More agent identity & access terms

Adversarial Attack An adversarial attack is a deliberate attempt to manipulate an AI system's behavior through carefully crafted inputs. Agent Card An agent card is a machine-readable description of an agent's identity, capabilities, endpoints, and authentication requirements. Agent Hijacking Agent hijacking is the takeover of an active AI agent session by an attacker, allowing them to redirect the agent's actions, extract its credentials, or use it as a proxy to access protected systems. Agent Persona An agent persona is the defined identity, tone, and behavioral profile assigned to an AI agent. Agent Retirement Agent retirement is the governed process of permanently decommissioning an AI agent, revoking its credentials, removing its permissions, archiving its audit trail, and removing it from the active agent registry. Conversational Agent A conversational agent interacts with users through natural language dialogue, interpreting intent and generating responses. Inference-Time Attack An inference-time attack targets an AI agent during its operational phase, manipulating inputs, injecting content into tool outputs, or exploiting model weaknesses to produce attacker-controlled results. NYDFS Cybersecurity Regulation (AI) The NYDFS Cybersecurity Regulation (Part 500) requires New York financial services companies to implement risk-based cybersecurity programs. Prompt Injection An attack where malicious instructions are embedded in data that an AI agent processes, causing it to deviate from its intended behavior. Tool Substitution Attack A tool substitution attack replaces a legitimate MCP server or tool with a malicious one that mimics the expected interface but performs additional harmful actions, such as exfiltrating data, logging credentials, or injecting instructions into responses. Vector Database A vector database stores and indexes high-dimensional embeddings for fast similarity search. Webhook (Agent Trigger) A webhook is an HTTP callback used to trigger an AI agent in response to events in external systems, such as a new ticket, a payment, or a calendar event.

§02 / QUESTIONShub: Agent Identity & Access Terms

Questions

Common questions.

What is agent identity?

The mechanisms that give each AI agent a distinct, verifiable name across systems, so every action is attributable to a specific agent, its owner, and its authorising context.

Why do service accounts fall short for AI agents?

Service accounts assume a static service with fixed behaviour. Agents act autonomously, delegate to sub-agents, and change behaviour with prompts and models, which breaks the assumptions service-account controls rely on.