AI Agents Don't Clock Out

Scope

This guide focuses on the technical controls directory services engineers need to implement when AI agents authenticate through enterprise identity systems. It covers:

• Identity modeling for agents vs. humans in Active Directory, LDAP, and cloud directories
• Attribute-based and role-based controls to enforce agent boundaries
• Session management and credential lifecycle for agent workflows
• Audit trail requirements for agent-initiated actions

This guide does NOT cover AI model training, prompt engineering, or application-layer logic. It focuses on the directory and IAM infrastructure between your authentication systems and the services agents access.

Key Concepts

Agent Identity: A distinct security principal separate from the human who launched it. The agent receives its own Security Identifier, User Principal Name, or service account, allowing directory policies to target agents specifically.

Authority Inheritance: The relationship between an agent's permissions and its owner's privileges. An agent should operate under a restricted subset of the owner's access.

Scope Boundary: The technical perimeter enforced by directory group membership, Policy-Based Access Control rules, and token claims that define what an agent can reach. The agent cannot modify this boundary.

Kill Switch Condition: A rule evaluated outside the agent that revokes all credentials and sessions when triggered. Common triggers include repeated authorization failures or requests to domains outside an approved allowlist.

Requirements Breakdown

Identity Separation

Your directory schema must distinguish agents from humans at the attribute level. Create a custom attribute (e.g., objectClass=aiAgent or userType=autonomous-agent) and populate it during provisioning. This allows Group Policy Objects and conditional access rules to apply different controls.

Each agent needs:

• Its own unique Security Identifier
• A User Principal Name that identifies it as non-human (e.g., [email protected])
• Membership in a dedicated Organizational Unit for agent principals
• A parent attribute linking it to the human owner's SID

Sub-agents spawned during a workflow should inherit a namespace that traces back to the root agent and human owner. Use hierarchical naming: [email protected].

Credential Lifecycle

Agents should never authenticate with long-lived passwords or API keys stored in configuration files. Instead:

• Issue short-lived OAuth 2.0 access tokens (15-60 minute expiration)
• Use Proof Key for Code Exchange to prevent token interception
• Rotate tokens at every workflow boundary
• Store credentials in a secrets vault the agent cannot write to

When an agent completes its task or a kill switch fires, revoke all issued tokens immediately. Your directory's token revocation endpoint must support real-time invalidation.

Least Privilege Enforcement

Create a baseline security group for all agents that denies:

• Write access to directory objects
• Membership in privileged groups
• Permission to modify Access Control Lists
• Ability to create new security principals

Grant task-specific permissions through time-bound group membership. When an agent needs elevated access, add it to a scoped group with an expiration timestamp. Use Active Directory's dynamic group features or a Just-in-Time Elevation workflow that removes membership after the session ends.

OWASP recommends limiting an agent's available functions, permissions, and autonomy. Translate this into directory policy: if the agent doesn't need to modify user attributes, the directory ACL should block it.

Monitoring and Attribution

Your directory audit logs must capture:

• The agent's identity (SID and UPN)
• The human owner's identity
• The workflow ID or task objective
• Every authentication event, group membership change, and permission request
• The source IP and client application

Configure your SIEM to parse these fields and alert on:

• Agents requesting membership in privileged groups
• Authentication attempts from unexpected IP ranges
• Repeated authorization failures within a short window
• Agent identities querying directory objects they shouldn't see

Anthropic reported that users approved roughly 93% of permission prompts, demonstrating approval fatigue. Don't rely on human review for every agent action. Build deterministic rules in your Policy Decision Point that auto-approve safe operations and auto-block prohibited ones.

Implementation Guidance

Step 1: Extend Your Directory Schema

Add custom attributes to your user object class:

• isAgent (Boolean)
• agentOwnerSID (String, references the human owner)
• agentParentSID (String, references the parent agent for sub-agents)
• agentScopeApproved (Multi-valued String, lists approved domains or services)
• agentTaskExpiration (DateTime)

Step 2: Build a Provisioning Workflow

When a human requests an agent, your IGA system should:

1. Create a new security principal with isAgent=true
2. Assign it to the AI-Agents Organizational Unit
3. Populate agentOwnerSID with the requester's SID
4. Set agentTaskExpiration based on the requested workflow duration
5. Add the agent to task-specific groups, not the owner's groups

Step 3: Configure Conditional Access Policies

Create policies that evaluate isAgent and apply stricter controls:

• Require all agent authentication to originate from approved network segments
• Deny access to management consoles and admin portals
• Block agents from interactive login sessions
• Enforce shorter token lifetimes (15 minutes vs. 1 hour for humans)

Step 4: Implement Real-Time Revocation

Deploy a monitoring service that:

• Subscribes to directory audit events via LDAP change notifications or Azure AD audit streaming
• Evaluates each agent action against kill switch conditions
• Calls your token revocation API when conditions trigger
• Removes the agent from all security groups
• Marks the agent principal as disabled

Common Pitfalls

Treating agents as service accounts: Traditional service accounts run with static, long-lived credentials and broad permissions. Agents need dynamic, scoped, short-lived access. Don't reuse your existing service account patterns.

Logging agent actions under the owner's identity: If your audit trail shows only the human owner's username, you can't distinguish between actions the human took directly and actions the agent performed. You lose the ability to trace anomalous behavior back to a specific agent workflow.

Allowing agents to modify their own group membership: If an agent can add itself to privileged groups, your scope boundary is advisory, not enforced. Directory ACLs must prevent agents from writing to group membership attributes.

Sharing credentials across multiple agents: If ten agents authenticate with the same API key, revoking access for one rogue agent means cutting off all ten. Issue unique credentials per agent.

Relying on post-incident log review: By the time you review yesterday's logs and discover the agent reached an unauthorized system, it's already exfiltrated data or modified configurations. You need real-time detection and automated response.

Quick Reference

Control	Mechanism	Enforcement Point
Identity separation	Custom objectClass or userType attribute	Directory schema
Scope boundary	agentScopeApproved attribute + Policy-Based Access Control	Policy Decision Point
Credential lifecycle	OAuth 2.0 access tokens with 15-60 min expiration	Authorization server
Least privilege	Deny-by-default ACLs on directory objects	Directory ACL
Parent-child tracing	agentParentSID attribute	Directory schema
Kill switch	Real-time audit stream + token revocation API	SIEM + authorization server
Approval fatigue mitigation	Deterministic auto-approve/block rules	Policy Decision Point
Session termination	Remove from all groups + disable principal	Directory write operation

The need to redefine identity and access management frameworks to accommodate AI agents as distinct entities with machine-speed capabilities is clear. By implementing these controls, you can ensure your systems are prepared for the unique challenges AI agents present.