Watch · narrated walkthroughs
An autonomous agent is a non-human principal that provisions itself, calls other services, delegates to sub-agents, and outlives any single request — and human identity systems were never designed for it. This series builds operational identity governance for agents from the ground up: why agents break human IAM and what a machine identity actually needs, how to provision and attest an identity so its bearer can be proven rather than assumed, how to run the credential lifecycle with short-lived tokens, rotation, and bounded delegation chains at runtime, how to decommission and revoke an agent's authority cleanly and provably, how to govern a whole fleet with an identity inventory, least-privilege drift detection, and lifecycle audit, and how to prove revocation actually works with recurring drills that time when every verifier, including partner services, starts refusing. Grounded in NIST SP 800-207 Zero Trust Architecture, NIST SP 800-63 Digital Identity Guidelines, the SPIFFE workload-identity specification, the OAuth 2.0 and Token Exchange RFCs, the OWASP Agentic Security Initiative, and the NIST AI RMF.