Governing the Fleet: Identity Inventory, Least-Privilege Drift, and Lifecycle Audit

The controls that secure one agent identity — proving it at provisioning, keeping its credential short-lived, revoking it cleanly — all quietly assume you know the identity exists. At the scale of a fleet, that assumption is the whole problem. Agents are created and destroyed by automation faster than any human process can track, they accumulate permissions as their tasks evolve, and a single identity that the system has forgotten is a principal acting with no oversight at all. Fleet governance is the discipline that closes this gap: maintaining a complete inventory of every agent identity, detecting when privileges drift away from least-privilege, and auditing that the lifecycle behaves as designed. This article treats all three as facets of a single continuous reconciliation between the identity state you intend and the identity state you actually have.

Why the Fleet Is a Different Problem

Securing an individual identity and securing a fleet of them differ in kind, not degree. An individual control answers a question about one principal: is it who it claims, is its credential fresh, has its authority been revoked. A fleet control answers a question about a population: do we know every principal that exists, are their permissions collectively still minimal, does the lifecycle hold across all of them. The population questions cannot be answered by applying the individual controls more times, because they depend on completeness — on there being no identity the system has lost track of.

This completeness requirement is what makes governance hard. A fleet is a churning set of short-lived principals; agents spawn sub-agents, tasks create ephemeral workers, and each is an identity that must be accounted for from creation to teardown. If even a small fraction escape the record — created outside the sanctioned path, or not cleaned up after decommissioning — the fleet accumulates unknown principals, and an unknown principal is precisely the thing an attacker wants to become. The NIST AI Risk Management Framework (AI RMF 1.0) places inventory at the base of its governance function for exactly this reason: you cannot manage risk for systems you have not enumerated.

The framing that follows treats fleet governance as continuous reconciliation. There is an intended state — the set of identities that should exist, each with the permissions it should hold, moving through the lifecycle it should follow — and an actual state, which is whatever is really running. Governance is the ongoing work of measuring the gap between them and driving it to zero, and every pillar below is an instance of that same loop applied to a different facet of identity.

The Identity Inventory

The inventory is the authoritative record of every agent identity that exists, and it is the foundation everything else rests on. To be useful it must be complete (every identity appears), current (it reflects creations and teardowns as they happen, not on a weekly lag), and attributed (each entry records not just that an identity exists but what workload it belongs to, what it is entitled to, and where it sits in any delegation tree). An inventory that is merely a stale list is worse than none, because it invites false confidence that the fleet is understood.

Completeness is enforced structurally, not by hoping agents register themselves. The sound pattern is that identity can only be minted through the sanctioned issuing path — the attestation-and-issuance authority — so the act of creating an identity is the act of recording it. In the SPIFFE model, where a workload's identity is issued by registering it with the issuing infrastructure, the registration set is the inventory: nothing can obtain a verifiable identity without appearing there. This closes the gap by construction, because an identity created outside the path simply has no valid credential and is rejected at every verifier.

The inventory is naturally relational, because agent identity is not a flat list but a web of entities: identities own credentials, credentials carry scopes, and identities delegate to other identities. Modeling these relationships explicitly is what lets governance answer questions that matter — which identities can reach a given resource, which delegations descend from a compromised parent, which credentials are about to expire — that a flat list cannot. The inventory, in other words, is a small graph, and its edges are as important as its nodes.

Least-Privilege Drift

With a complete inventory in place, the next governance question is whether the fleet's permissions are still minimal. Least privilege is the principle that a principal should hold only the authority its current task requires; least-privilege drift is the slow violation of that principle as, across many agents and many changes, permissions are granted and never removed. Each individual grant is reasonable in the moment — an agent needed a new capability for a new task — but the accumulation is a fleet whose principals collectively hold far more authority than their work requires, enlarging the blast radius of any single compromise.

Drift is measurable, and the measurement is the comparison between granted and exercised authority. For each identity, the scope it holds can be compared against the scope it actually uses over a representative window; the gap between them is unused privilege, the standing authority that contributes only risk. A fleet-wide view of this gap — which identities hold the largest unused scopes — turns an abstract principle into a prioritized worklist, because the identities with the widest gap between granted and used are the ones whose over-provisioning most enlarges the attack surface.

The remedy follows from the measurement: permissions should be granted narrowly and expire by default rather than persist, so that unused authority decays instead of accumulating. This is the same discipline that delegation applies per hop — narrow to the need — extended across time. Where standing permissions are unavoidable, the drift measurement becomes the control: an identity whose used scope has shrunk well below its granted scope is a candidate for having the difference revoked, closing the gap the drift opened. The OWASP Agentic Security Initiative names excessive permissions and excessive agency among the core agentic risks, and least-privilege drift is how a fleet slides into them without any single decision that looks wrong.

Lifecycle Audit

The third pillar asks whether the identity lifecycle actually behaves as designed across the whole fleet. It is not enough to have specified that credentials are short-lived, that delegation narrows, and that decommissioning is complete; governance must verify that these properties hold in the running system, because a control that is specified but silently broken provides no protection. Lifecycle audit is the continuous checking of the fleet's real behavior against its intended invariants.

The audit is a set of concrete checks against the inventory and the identity events it records. Are all live credentials within their intended lifetime, or has some issuer begun handing out long-lived ones? Does every delegation edge narrow scope relative to its parent, or has some path begun inheriting authority whole? Does every decommissioned identity have no surviving credentials or orphaned children? Is every live identity attributable to a current, sanctioned workload, or are there identities whose workload no longer exists? Each check is a comparison between an invariant the lifecycle promises and the fleet's actual state, and each failure is a governance finding to drive to resolution.

Framing audit as continuous rather than periodic is the key shift. A quarterly review of a fleet that turns over in minutes is theatre; by the time a review runs, the population it examined is gone. The zero-trust posture of NIST SP 800-207 — continuous monitoring and per-request evaluation rather than point-in-time trust — applies to governance as much as to access: the audit must run continuously against the live inventory, so that a broken invariant surfaces in minutes, not months. This is also where lifecycle audit connects back to inventory completeness, because every audit check presupposes that the inventory it runs against is complete; an audit over a partial inventory certifies only the part it can see.

A Maturity Ladder for Fleet Governance

The three pillars build on one another, which suggests a natural order of adoption. At the base is inventory: a complete, current, attributed record of every identity, enforced by making the issuing path the only way to mint one. Nothing above works without it, because both drift detection and audit run against the inventory. Once inventory is trustworthy, least-privilege drift detection becomes possible, comparing granted against used authority across the fleet to find and shrink standing over-provisioning. With inventory and privilege under control, continuous lifecycle audit verifies that the whole lifecycle — provisioning, rotation, delegation, decommissioning — actually holds in the running system.

The ladder is worth stating because teams often reach for the top rung first, standing up dashboards and audits over an inventory they have not made complete. An audit over a partial inventory is precisely the false confidence this discipline exists to avoid: it reports green for the identities it knows about while the ungoverned ones — the very population most likely to harbor a problem — go unexamined. The disciplined path is to earn each rung before the next: make the inventory complete, then measure and shrink drift, then audit the lifecycle continuously. Each rung makes the next meaningful, and skipping one hollows out the ones above it.

Limitations and Threats to Validity

This treatment is an architectural synthesis grounded in established standards, and its guarantees rest on assumptions worth stating plainly. The inventory's completeness depends entirely on the issuing path being the sole route to a usable identity; any side channel by which a workload can obtain credentials — a leaked long-lived key, a misconfigured issuer, a shared secret — creates identities the inventory never sees, and every control above inherits that blind spot. Enforcing the single path, and monitoring for credentials that did not come through it, is therefore the precondition for the whole discipline, not a detail.

The drift measurement also has limits. Comparing granted against used authority requires a representative window of usage; an agent that legitimately exercises a permission rarely can look like drift, so the measurement identifies candidates for review rather than automatic revocation, and pruning must account for infrequent-but-necessary authority. And continuous audit is only as good as the invariants it encodes: it verifies the properties someone thought to check, and a lifecycle weakness no check looks for passes silently. The honest posture is that fleet governance dramatically narrows the space of unknown and over-privileged identities but does not eliminate it; it turns identity from an unmanaged sprawl into a measured, reconciled population, which is the precondition for every other agent-security control to mean what it claims. Governance makes the fleet knowable; it is the other controls, running over that knowable fleet, that keep it safe.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

audit_invariants:
  - name: short_lifetimes
    assert: all(cred.ttl <= max_ttl for cred in live_credentials)
  - name: narrowing_delegation
    assert: all(edge.child_scope subset_of edge.parent_scope for edge in delegations)
  - name: clean_decommission
    assert: all(no_live_credentials(id) and no_orphan_children(id)
                for id in decommissioned)
  - name: live_attribution
    assert: all(workload_exists(id.workload) for id in live_identities)
  - name: complete_inventory
    assert: all(cred.issued_via == sanctioned_path for cred in live_credentials)
  on_fail: open_finding(severity=high)

Glossary

Fleet governance

The discipline of securing a whole population of agent identities through inventory, least-privilege drift control, and lifecycle audit, framed as continuous reconciliation of intended versus actual state.

Identity inventory

An authoritative record of every agent identity that exists — complete, current, and attributed to a workload, its scope, and its place in any delegation tree.

Least privilege

The principle that a principal should hold only the authority its current task requires.

Least-privilege drift

The slow accumulation of permissions across a fleet as authority is granted for evolving tasks and never removed, enlarging collective blast radius.

Unused privilege

The gap between the scope an identity holds and the scope it actually exercises — standing authority that contributes only risk.

Lifecycle audit

Continuous verification that the identity lifecycle's specified invariants actually hold across the running fleet.

Continuous reconciliation

The ongoing measurement and closing of the gap between the identity state a system intends and the state it actually has.

Completeness (of inventory)

The property that every identity that exists appears in the inventory, without which no fleet-level control can be trusted.

References

1. NIST AI 100-1, AI Risk Management Framework (AI RMF 1.0)
2. NIST SP 800-207, Zero Trust Architecture (2020)
3. NIST SP 800-63-3, Digital Identity Guidelines (2017)
4. SPIFFE — Secure Production Identity Framework For Everyone, specification (CNCF)
5. IETF RFC 8693, OAuth 2.0 Token Exchange
6. IETF RFC 7519, JSON Web Token (JWT)
7. IETF RFC 6749, The OAuth 2.0 Authorization Framework
8. OWASP Agentic Security Initiative, Agentic AI Threats and Mitigations (2025)