Agent Identity and Lifecycle Governance

An autonomous agent is a non-human principal that provisions itself, calls other services, delegates to sub-agents, and outlives any single request — and human identity systems were never designed for it. This series builds operational identity governance for agents from the ground up: why agents break human IAM and what a machine identity actually needs, how to provision and attest an identity so its bearer can be proven rather than assumed, how to run the credential lifecycle with short-lived tokens, rotation, and bounded delegation chains at runtime, how to decommission and revoke an agent's authority cleanly and provably, and how to govern a whole fleet with an identity inventory, least-privilege drift detection, and lifecycle audit. Grounded in NIST SP 800-207 Zero Trust Architecture, NIST SP 800-63 Digital Identity Guidelines, the SPIFFE workload-identity specification, the OAuth 2.0 and Token Exchange RFCs, the OWASP Agentic Security Initiative, and the NIST AI RMF.