Learn / Identity and least privilege for agents and tools
Identity and least privilege for agents and tools
Scoping identities, tokens and permissions so agents and the tools they call can only do what they need to.
Researched on 2026-09-26 with AI assistance. Links and summaries can change; verify details with the original source. Not yet reviewed by a person.
What it is
This skill is about giving an agent and each tool it calls its own identity, then cutting the permissions attached to that identity down to the specific actions, resources and conditions the task needs. On managed platforms this is concrete work: a trust policy plus resource-scoped statements for the models, schemas, knowledge bases and Lambda functions an agent touches, with wildcards replaced by specific agent IDs once they exist.3
Cloud providers now treat an agent as a distinct principal rather than a shared service account. Google Cloud Agent Identity issues each agent a SPIFFE-based, attested identity that is not shared by multiple workloads by default, cannot be impersonated, does not allow long-lived key generation, and whose access tokens are cryptographically bound to the agent's X.509 certificates to prevent token theft.4
It also covers the authorization path between an agent and its tools. In MCP over HTTP the server acts as an OAuth 2.1 resource server: it must publish Protected Resource Metadata (RFC 9728), return WWW-Authenticate on 401, and clients must discover the authorization server and use its metadata (RFC 8414).1
Because untrusted text can hijack an agent's plan, permissions become the control that decides how far a successful injection travels, so this skill sits between AppSec and cloud IAM rather than inside either one.87
Why postings ask for it
7 of 48 postings ask for it (15%), and it concentrates in design roles: 43% of the 7 AI Security Architect postings, 19% of the 16 AI/Agent Security Engineer postings, 11% of the 9 AI Red Team postings, and none in research, GRC or consulting.P
Architect and engineer demand tracks the work CISA and international partners flag for agentic deployments: expanded attack surface, privilege creep and obscure event records, with the recommendation to avoid granting broad or unrestricted access to sensitive data or critical systems.P6
Red team interest is smaller but real, because agent tool chains fail through identity: hijacked or poorly vetted registry entries reach hosts, and attacker-controlled tool metadata then shapes host behaviour.P9
Concepts you should be able to explain
If you can say each of these out loud in two minutes, with an example, you are ready for the technical part of an interview on this skill.
An agent gets its own attested credential instead of borrowing a shared service account. Google Cloud Agent Identity assigns each agent a SPIFFE ID of the form spiffe://TRUST_DOMAIN/resources/SERVICE/RESOURCE_PATH, tied to the agent's lifecycle and mapped to the resource URI where it is hosted, and the same value appears in IAM allow policies as principal://. Unlike service accounts, these identities are not shared by default and do not permit long-lived keys.4
SPIFFE standardises three things: an identity namespace (the SPIFFE ID, a URI), a verifiable identity document (SVID, encoded as an X.509 certificate, JWT or WIT token) that can be proven authentic and proven to belong to the presenter, and a Workload API through which a workload obtains its SVIDs. The Workload API is usually exposed over a local Unix domain socket and deliberately has no authentication handshake, so the caller is attested out of band, for example by inspecting process properties.5
In MCP, authorization is optional and applies at the transport level; HTTP transports should follow the spec while STDIO transports should not and instead take credentials from the environment. When used, the MCP server is the resource server, the client is the OAuth client, and the flow builds on OAuth 2.1 draft, RFC 8414, RFC 7591 and RFC 9728. Servers must expose Protected Resource Metadata listing at least one authorization server; clients must parse WWW-Authenticate on 401 to find it.1
An MCP proxy that fronts a third-party API with one static client ID, while letting MCP clients dynamically register their own client IDs, can be abused once the third-party authorization server has set a consent cookie. A crafted link with an attacker redirect URI and a new client ID skips the consent screen, and the authorization code is redirected to the attacker, who exchanges it for tokens. Mitigation is per-client consent stored server-side, keyed to client_id, plus exact redirect_uri matching, CSRF protection and clickjacking defences.2
On Amazon Bedrock Agents you replace the auto-created role with a custom one: a trust policy allowing Bedrock to assume it, plus identity-based statements only for the base models, the S3 objects holding action group OpenAPI schemas, and the knowledge bases actually attached. Statements for collaborators, provisioned throughput, guardrails, prompt management and KMS decrypt are added only if that feature is used, condition keys are recommended, and the guidance is to replace * with specific agent IDs after creation. Action group Lambda functions also need a resource-based policy allowing the role to invoke them.3
Two different permission models sit side by side. Acting for a user means 3-legged OAuth with user consent and token management; acting on its own authority means a cloud identity for same-cloud resources, or 2-legged OAuth for machine-to-machine calls to external services, with API keys as a fallback and HTTP basic auth explicitly not recommended. In the Google Cloud design, end-user credentials are encrypted by the auth manager and decrypted at the gateway so the agent never holds the raw credential.4
Prompt injection exploits an agent's reliance on natural language input and is most dangerous when the agent has tool access or handles sensitive data. Rather than trying to detect every injection, design patterns constrain what the agent is allowed to do, with documented trade-offs between utility and security. That makes permission scoping, not filtering, the load-bearing control.8
Progent expresses privilege as symbolic rules over tool names and arguments, checked deterministically on every tool call, so unnecessary calls are blocked while task-needed ones pass. Policies are generated from the user's task and updated during execution, with an SMT solver deciding whether an update narrows the policy (applied automatically) or expands it (requires explicit approval), so the effective action space can only shrink without approval. Evaluated on AgentDojo and ASB, it cut attack success rates while keeping utility, and was shown in LangChain and the OpenAI Agents SDK.7
Use fictional data and authorised sandboxes. Remove employer details and secrets from any portfolio write-up. Time estimates exclude setup. Check model and cloud costs before running tests, set spending limits, and delete lab resources afterwards.
Three exercises
In order of difficulty. Free tools. Keep what you build; it is evidence.
A one-page table of every tool an agent can call, the identity it uses, the resources that identity can reach, and at least three over-grants with the narrower replacement written out.34
- Pick one agent you can read the config for (or the Bedrock Agents service role example) and list its tools, action groups and data stores.
- For each entry record the principal used, the actions allowed, the resource ARNs or URLs, and any conditions.
- Compare against the Bedrock guidance: drop statements for features not in use, add condition keys, and replace * with specific agent IDs.
- Note where the agent acts for a user versus on its own authority, using the two authority models as the split.
- Write the three worst over-grants and the exact scoped statement you would ship instead.
Tools: text editor, spreadsheet, AWS and Google Cloud public docs
A short write-up showing one tool abuse you achieved locally and the authorization changes that close it, mapped to specific spec requirements.1012
- Run Damn Vulnerable MCP Server locally and connect an MCP client.
- Work through the challenges that involve excessive tool permissions and credential exposure, recording each successful action.
- For each finding, name the missing control from the MCP authorization spec: Protected Resource Metadata, WWW-Authenticate on 401, authorization server metadata discovery.
- Write the confused deputy scenario for this server: static client ID plus dynamic client registration plus consent cookie, and the per-client consent fix.
- Re-test after applying or stubbing the fix and record what no longer works for the attacker.
Tools: Python, Damn Vulnerable MCP Server, any local MCP client
A demo where an agent role escalates to broader access through a chained permission, plus a rewritten policy and a call-level allowlist that blocks the chain.1173
- Deploy the deliberately vulnerable AWS lab that chains iam:PassRole with lambda:CreateFunction into a throwaway account that holds no production data, reproduce the escalation end to end, then destroy the stack and confirm no Lambda, role or secret is left behind.
- Rewrite the role so the chain fails: scope PassRole to named roles, add condition keys, and split the agent role from the execution role.
- In front of a small local agent, add a deterministic check on every tool call using rules over tool name and arguments, in the style of Progent.
- Implement narrowing updates automatically and require explicit approval for any expansion, then log both.
- Run one injected instruction that tries to reach a blocked tool and show the denial plus the audit record.
Tools: AWS free tier or local emulation, the iam:PassRole plus lambda:CreateFunction privilege escalation lab repo, Python, a local agent framework
Practice questions
Written from the concepts above, not collected from a named employer. Open one, answer it out loud, then tick the points you covered; the score stays in this browser.
Why is a shared service account a poor identity for an agent, and what does an agent-specific identity change?Agent identity as a first-class workload identity
Say your answer out loud or write it down, then tick what you covered:
0 of 4 covered
Walk me through how an MCP client discovers where to get a token for a protected MCP server.MCP server as an OAuth 2.1 resource server
Say your answer out loud or write it down, then tick what you covered:
0 of 4 covered
A team is building an MCP proxy in front of a third-party SaaS API. What identity risk do you raise first?Confused deputy in MCP proxy servers
Say your answer out loud or write it down, then tick what you covered:
0 of 4 covered
How would you review the IAM role of an agent running on a managed platform?Scoping a managed agent service role
Say your answer out loud or write it down, then tick what you covered:
0 of 4 covered
If you cannot reliably detect prompt injection, what do you do instead?Privilege as the containment boundary for prompt injection
Say your answer out loud or write it down, then tick what you covered:
0 of 4 covered
What does monotonic confinement mean for a runtime permission policy, and why does it matter?Tool-call level policy and monotonic confinement
Say your answer out loud or write it down, then tick what you covered:
0 of 4 covered
An agent needs a user's Jira tasks and also needs to write to a cloud bucket. How do you split the credentials?Delegated user authority versus the agent's own authority
Say your answer out loud or write it down, then tick what you covered:
0 of 4 covered
What identity-side risks would you put in a board-level summary of an agentic AI rollout?CISA, US and International Partners Release Guide to Secure Adoption of Agentic AI
Say your answer out loud or write it down, then tick what you covered:
0 of 4 covered
Sources
Every numbered claim above links here. P = the platform's own coding of 48 job postings.
- MCP Authorization specification (2025-06-18) Model Context Protocol
- MCP Security Best Practices (confused deputy and mitigations) Model Context Protocol
- Create a service role for Amazon Bedrock Agents AWS
- Agent Identity overview (Google Cloud IAM) Google Cloud
- SPIFFE: Secure Production Identity Framework for Everyone (specification) SPIFFE / CNCF
- CISA, US and International Partners Release Guide to Secure Adoption of Agentic AI CISA
- Progent: Securing AI Agents with Privilege Control arXiv
- Design Patterns for Securing LLM Agents against Prompt Injections arXiv
- A First Look at the Security Issues in the Model Context Protocol Ecosystem arXiv
- Damn Vulnerable MCP Server Open source (community)
- AWS IAM privilege escalation lab: iam:PassRole plus lambda:CreateFunction Open source (community)
Resources
Free first. Levels: intro means no prior knowledge of this skill; working means you can apply it on a project; advanced means research depth or specialist tooling.
- introOWASP Agentic Skills Top 10 (includes AST03 Over-Privileged Skills) OWASP, Standard freeGives you named risk categories for over-permissioned agent skills and manifests, so you can frame findings and controls in language teams already accept.EngineerArchitectRed teamerGovernance
- introIntroduction to Microsoft Entra Agent ID Microsoft Learn, Course freeExplains agent identity constructs in an enterprise directory so you can tell agent identities from service principals and users.EngineerArchitectGovernance
- introThe OWASP Top 10 for Agentic Applications: what developers building with AI agents need to know WorkOS, Guide freeShort read that connects the agentic risk list to identity decisions, useful before you argue for scoped tokens in a design review.EngineerArchitectConsultant
- introAgent Identity overview (Google Cloud IAM) Google Cloud, Guide, about 1 h freeShows what a cryptographically attested, SPIFFE-based identity per agent looks like and how it authenticates to MCP servers.EngineerArchitect
- introOWASP ASI03: Identity and Privilege Abuse in AI Agents Adversa AI, Guide, about 0.5 h freeWalks one OWASP agentic risk end to end, so you can map identity abuse paths to concrete controls in your own stack.EngineerRed teamerGovernance
- introCISA and international partners: guide to secure adoption of agentic AI CISA, Standard freeGives GRC and architecture leads a government baseline to cite when arguing for scoped agent identities and permission limits.GovernanceArchitectConsultant
- workingSPIFFE and SPIRE in the AuthPlayground Ping Identity (developer portal), Hands-on lab, about 2 h freeInteractive walkthrough of issuing and validating workload identities for orchestrators, planner and retrieval agents.EngineerArchitectRed teamer
- workingUnderstanding Authorization in MCP (OAuth 2.1 tutorial) Model Context Protocol, Guide, about 2 h freeTakes you from concept to a working OAuth 2.1 flow for an MCP server, including scopes and resource protection.EngineerArchitect
- workingImplement security for AI (learning path, 9 modules) Microsoft Learn, Course freeCovers securing agent identities with Conditional Access and assessing an agent identity's blast radius and attack paths in a real tenant.EngineerArchitectGovernance
- workingMCP server authorization (Cloudflare Agents docs) Cloudflare, Guide freeImplementation notes for splitting login from consent when you expose a remote MCP server, which is where scope creep usually starts.EngineerArchitect
- workingAWS IAM privilege escalation lab: iam:PassRole plus lambda:CreateFunction David Bode-Disu (open source), Hands-on lab freeYou escalate a wildcard iam:PassRole into admin credentials, which is exactly the mistake made when wiring an over-broad execution role to an agent.Red teamerEngineerArchitect
- workingmcp-scanner (MCP server audit: auth configuration, tool poisoning, credential leaks) MK ScorpioSec (open source, MIT), Tool freeRun nine checks against an MCP server or a Claude Desktop config before connecting an agent, including missing authentication and context exfiltration.EngineerRed teamerConsultant
- workingWorkload identity federation with SPIFFE (OpenAI API) OpenAI, Guide, about 1 h freeShows how to swap a long-lived model API key for a short-lived token minted from an attested workload identity.EngineerArchitect
- workingAgent Governance Toolkit: OWASP Agentic Security Initiative reference architecture mapping Microsoft (open source toolkit), Tool, about 3 h freeWorked example of mapping agent identity and privilege controls to OWASP agentic risks, reusable as a control matrix template.GovernanceArchitectConsultant
- workingAgentic AI: Threats and Mitigations OWASP Agentic Security Initiative, Guide, about 4 h freeGives the threat taxonomy behind agent permission design, including excessive agency and identity abuse, with mitigations you can assign to owners.EngineerArchitectRed teamerGovernanceConsultant
- workingCreate a service role for Amazon Bedrock Agents AWS, Guide, about 1 h freeConcrete trust policy and resource-scoped permission examples for an agent execution role you can copy and then tighten.EngineerArchitect
- workingAI Controls Matrix (AICM) v1.1 Cloud Security Alliance, Standard, about 3 h freeControl catalogue with IAM domains you can use as audit evidence structure for agent and tool permission reviews.GovernanceArchitectConsultant
- workingDamn Vulnerable MCP Server Open source (community), Hands-on lab, about 6 h freeHands-on practice exploiting missing auth, excessive tool scope and token leakage in an MCP server you control.Red teamerEngineer
- workingDesign Patterns for Securing LLM Agents against Prompt Injections arXiv (Beurer-Kellner et al.), Paper, about 2 h freeGives named patterns that constrain what an agent may call after untrusted input, the design layer above IAM policy.EngineerArchitectResearcherRed teamer
- advancedSPIFFE specification SPIFFE (CNCF), Standard, about 3 h freeThe identity and issuance standard now underneath several agent identity products, so you can judge their attestation claims.ArchitectEngineerResearcher
- advancedMCP Authorization specification (2025-06-18) Model Context Protocol, Standard, about 2 h freeThe normative text on resource indicators, metadata discovery and token audience, which is what you test MCP servers against.EngineerArchitectRed teamer
- advancedProgent: Securing AI Agents with Privilege Control arXiv, Paper freeThe reference point for runtime privilege control over tool calls, including how policies change with task state and the security versus utility trade-off.ResearcherArchitectEngineer
- advancedRTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage arXiv, Paper freeExplains information-flow labelling of tool data so confirmation prompts fire only when they matter, a design pattern architects can copy.ResearcherArchitectEngineer
- advancedA First Look at the Security Issues in the Model Context Protocol Ecosystem arXiv, Paper, about 2 h freeMeasures weak registry vetting and ownership checks, giving you supply chain questions to ask before an agent installs a server.Red teamerResearcherArchitect
- advancedMCP breach-to-fix labs Open source (PawelKozy), Hands-on lab, about 10 h freeReproduce ten real MCP incidents, then run the hardened server and pytest regressions that prove the permission fix holds.Red teamerEngineerConsultant
Gaps the research could not fill with a good free source: No free, vendor-neutral hands-on lab for scoping cloud execution roles (AWS/Azure/GCP) for agents; the cloud material found is product documentation, not exercises.; No free course from a standards body (OWASP, CSA, NIST, NCSC) on agent identity and delegation; the only free structured courses found were from a cloud vendor.; Could not confirm today the IETF drafts on OAuth for AI agents acting on behalf of a user, or the token exchange and protected resource metadata RFC pages, so no primary OAuth RFC is listed.; No benchmark or CTF that scores over-privileged tool scopes specifically; the available agent benchmarks target prompt injection outcomes rather than permission boundaries.; No free, maintained open-source policy engine example for agent tool authorization (Cedar, OPA style) surfaced in searches, so the tool slots are filled by identity issuance and governance tooling.
Paid options
Most of what postings ask for on this skill is covered by the free material above. These are the paid courses and certifications that touch it, with what they add and what free already covers. Showing 6 of 6: ones postings name first, then the most focused on this skill. All paid options.
- Cost
- GBP 365 is listed against Red Team Ops on Zero-Point's legacy training site course list; the current course page stated no price in the text we could read
- Duration
- Study time: 20 hours (as stated on the course page)
- Format
- self-paced
- Prerequisite
- None stated; the course page lists the level as Practitioner
- Renewal
- None stated; the page states lifetime access, course updates at no extra cost, lab access with no expiry, and unlimited free exam attempts
- In the 48 postings
- Named in 1 of 48 postings: Sr. AI Red Team Engineer (listed).
Adds over free material: Hands-on Cobalt Strike adversary simulation with a licensed copy provided in the labs, plus unlimited exam retries at no extra cost.
Free already covers: Free C2 frameworks, Active Directory attack labs and public adversary emulation plans cover the concepts, but not licensed Cobalt Strike practice.
- Cost
- not stated on the provider page
- Duration
- not stated
- Format
- exam only
- Prerequisite
- none stated
- In the 48 postings
- Named in 1 of 48 postings: a plus.
Adds over free material: Entry-level coverage of core security functions for people crossing in from IT or development rather than from a security role.
Free already covers: Free vendor and community training covers the same fundamentals; nothing in Security+ V7 is AI-specific.
- Cost
- USD 599 (US and all regions not otherwise listed, and Asia Pacific, Middle East, Africa); EUR 575.04 in EMEA; GBP 485.19 in the UK
- Duration
- not stated
- Format
- exam only
- Prerequisite
- not stated on the pages we read
- In the 48 postings
- Named in 2 of 48 postings: Cyber - AI Security - Senior - Consulting (a plus); Secure AI Engineer Manager (listed).
Adds over free material: Vendor-neutral cloud security coverage that satisfies the generic 'cloud security cert' wording in the field delivery posting without committing to one provider.
Free already covers: CSA Cloud Controls Matrix and the free guidance from AWS, Azure and Google cover the same control areas at no cost.
- Cost
- 300 USD
- Duration
- 170 minutes, 65 multiple choice or multiple response questions
- Format
- exam only
- Prerequisite
- No certification prerequisite. AWS states it is intended for people with five years of IT security experience and two or more years securing AWS workloads.
- Renewal
- Valid for 3 years; recertify by passing the latest version of the exam
- In the 48 postings
- Named in 2 of 48 postings: Sr. Security Solutions Architect, AI-Applied Guidance (a plus); Secure AI Engineer Manager (listed).
Adds over free material: Tests the IAM, encryption, data protection and detection controls you need to reason about when an AI workload runs on Bedrock, SageMaker or EKS, and it is the cert the AWS-facing architect posting named.
Free already covers: AWS Skill Builder digital courses, the free exam guide PDF and AWS security documentation cover the syllabus without payment.
- Cost
- USD 749 (US and all regions not otherwise listed, and Asia Pacific, Middle East, Africa); EUR 719.04 in EMEA; GBP 606.69 in the UK. Reschedule USD 50, cancellation USD 100.
- Duration
- not stated
- Format
- exam only
- Prerequisite
- 5 years required work experience, stated on the certification page. Exam-only purchase must be scheduled and sat within 365 days.
- In the 48 postings
- Named in 3 of 48 postings: Cyber - AI Security - Senior - Consulting (a plus); Information Security Architect - AI (listed); Security Engineer, AI (a plus).
Adds over free material: Covers the eight domains an AI security architect is expected to already know, including IAM, security architecture and engineering, and software development security, and is the credential most often listed by name in the GRC and architect postings here.
Free already covers: Nothing free replaces the credential itself, but the underlying material (NIST SP 800 series, cloud provider architecture guidance, OWASP) is all free.
- Cost
- not stated on the provider page
- Duration
- 7 hours self-paced, 7 CPEs
- Format
- self-paced
- Prerequisite
- at least intermediate Python; 16 GB RAM, 20 GB free disk, Rancher Desktop or Docker (Intel and ARM both supported); internet access needed during class
- In the 48 postings
- Not named in any of the 48 postings.
Adds over free material: Dockerised labs where you build RAG, contextual RAG and agentic RAG yourself and wire in access-control enforcement and prompt-injection defences, so you can review a retrieval pipeline you have actually built.
Free already covers: Vendor and framework docs plus OWASP LLM guidance already explain RAG architecture and the injection risks at concept level, and open tutorials show how to stand a RAG stack up.