Ephemeral Identity Is Not Access Control

The category has arrived. Eighteen months ago, “privileged access for AI agents” was a sentence you had to explain. As of mid-2026 it is a product line: the established identity platforms are shipping agent-identity frameworks, the cloud vendors are adding it to their own control planes, and at least one of them is buying ad slots on the blogs your engineers actually read. This is good. A category that incumbents are willing to spend money defending is a category that exists. We argued in an earlier essay that the window was open; the incumbents moving in is the market agreeing.

But there is a category error baked into the dominant framing, and it is worth naming precisely, because the framing is about to become the default and defaults are hard to dislodge once regulated buyers have written them into an architecture diagram.

The dominant answer to “how do we secure AI agents” is: give every agent a short-lived cryptographic identity that expires on its own. SPIFFE identities, X.509 certificates measured in minutes, mTLS between every service, JSON Web Tokens issued and validated on demand, a hardware root of trust underneath. The slogan is “ephemeral by design,” and the promise is that you eliminate static credentials — no more long-lived keys in a .env file, no more service-principal secret that was minted in 2022 and never rotated.

All of this is correct. It is also necessary. If you are still handing agents long-lived secrets, stop reading and go fix that first; nothing below matters until you do. Short-lived, cryptographically-attested workload identity is the floor.

It is not the building.

Identity answers a different question than access

Here is the distinction the framing elides. A short-lived certificate answers the question who is this agent? It does not answer the question may this agent take this action, right now, against this resource — and if it goes wrong, how fast can I stop it?

Those are different questions, they belong to different layers, and conflating them is how you end up with an architecture that is cryptographically immaculate and operationally defenceless.

Consider the concrete shape of a privileged agent action in an Azure tenant. An agent wired through an MCP client decides, mid-task, that it needs Microsoft.KeyVault secrets-officer rights on kv-payments-prod to read a connection string. In the ephemeral-identity model, the sequence is: the agent presents its workload identity, the platform verifies the certificate is valid and unexpired, a role is already bound to that identity or gets bound, and a fifteen-minute credential is issued. The agent does its work. The credential expires. The audit log records that it happened.

Read that sequence again and notice what is not in it. Nobody decided whether this specific action should occur. No human, and no policy scoped tighter than “this identity holds this role,” stood between the request and the grant. And for fifteen minutes — the whole life of that credential — the agent holds secrets-officer rights over a production payments vault, revocable only by waiting for the timer, because “expires automatically” is a passive mechanism. If the agent has been prompt-injected, or is looping on a bad plan, or is simply wrong, you have fifteen minutes of blast radius and no switch.

That is not access control. That is authenticated forensics. You will know exactly who did it. You will not have decided whether it happened, and you could not have stopped it.

What regulated agent access actually requires

For a team under PCI-DSS, HIPAA, or a NIST baseline, “we know who did it” is table stakes, not the deliverable. The deliverable is three things the ephemeral-identity layer does not provide, and cannot provide, because they live one layer up.

A witnessed gate. The privileged action — not the identity, the action — has to pass a decision surface before it executes. Sometimes that decision is a human approving a specific grant with a specific scope and a specific reason. Sometimes it is policy-as-code that can encode “an agent may read this vault but a human must witness any write.” The point is that authentication is not authorization of the act, and regulated control frameworks are written around the act. The entire thrust of “ephemeral by design” is to remove the human from the loop in the name of automation — which is exactly the property a compliance auditor will not sign off on for a production payments path. You cannot automate away the witness and then claim the witness’s assurance.

Instant, active revocation. A fifteen-minute TTL is fifteen minutes of exposure you have chosen in advance and cannot shorten in the moment. Active revocation is the opposite: when an agent goes wrong, you kill the grant and every credential it spawned in seconds, on command, not on a schedule. This is a cascade, and it is a designed mechanism, not a side effect of short expiry. The difference between passive expiry and active cascade is the difference between “the fire will burn out eventually” and “there is an extinguisher on the wall.” Both matter. Only one of them is access control.

Action-scoped blast radius. An identity with a role can do everything the role permits, for the life of the credential. An action-scoped grant can do the one thing it was witnessed for, and nothing else, and it evaporates the instant that thing is done or the instant you revoke it. The unit of control is the task, not the principal. When thirty to forty percent of privileged operations in a tenant are initiated by software on a per-task instruction — which is what the telemetry now shows — the per-task grant is the only unit that matches the shape of the risk.

The layer you build on versus the layer you sell

None of this is an argument against short-lived workload identity. It is an argument about which layer is the product.

SPIFFE and its cousins are plumbing — necessary, standards-based, worth adopting, and genuinely a solved-enough problem that reinventing it would be foolish. Build on it. But plumbing is not the building, and a privileged-access product whose entire value proposition is “we issue the certificate faster and shorter” has mistaken the floor for the structure. The certificate tells you the agent is who it claims. The access-control surface — the witnessed gate, the cascade, the per-action scope — is what decides whether the claim gets to matter, and what happens when it shouldn’t have.

There is a clean way to hold both ideas at once. Let the identity layer answer who. Let the access-control layer answer whether, how much, for how long, and how fast can I take it back. The first is a credential. The second is a decision surface with a kill switch, and it is a different piece of software with a different job.

The tell, if you are evaluating a platform, is simple: ask what happens in the ninety seconds after you realise an agent is doing something it should not. If the answer is “the credential will expire,” you have bought identity. If the answer is “you revoke the grant and its entire cascade, now, and here is the witnessed record of the decision that let it exist in the first place,” you have bought access control. For an agent holding rights over a production system, in a regulated shop, on a per-task instruction, at a rate that is climbing two points a month — the ninety seconds is the entire job.

Ephemeral identity is table stakes. Do it. Then build the thing that actually decides.