The words of agent security, defined plainly

An access token is a credential, usually short-lived, that proves an identity may call a service.

A token is only as limited as its scope and lifetime. A broad, long-lived token behaves like a password.

Agent reach is everything an AI agent can get to, directly or through other identities, tokens and tools.

Reach is about authority, not activity. An agent can reach data it has never touched, and the day it is tricked or misconfigured, that data is exposed.

An AI agent is software that decides on steps and takes actions with the access it is given, instead of only answering questions.

An agent acts as an identity. What it can do depends on the credentials, roles and tools it holds, not on what its instructions say.

An API key is a secret string that grants access to an API to whoever holds it.

Keys are long-lived and easy to copy. They end up in code, chat messages and configuration files.

An attack path is a chain of identities, grants and tools that leads from one starting point to sensitive data.

A single permission rarely looks dangerous. The risk sits in the chain: identity A can assume role B, which can read store C.

An authority path is the route along which an agent or identity gains the right to act on a resource, step by step.

Authority moves through grants, roles and credentials. Following it step by step shows where access actually comes from, not where it was meant to come from.

Blast radius is how much a single compromised or misused identity can affect.

The smaller the radius, the smaller the incident. Shared accounts and broad roles make it large.

A breakpoint is the single grant, key or connection whose removal cuts the most attack paths.

Fixing every finding is not realistic. Fixing the one grant that many paths share closes many routes with one change.

Credential rotation is replacing a secret with a new one on a schedule or after an incident, so an old copy stops working.

Rotation limits how long a leaked secret is useful. It only works when you know every place the secret is used.

Crown-jewel data is the set of data stores whose exposure would hurt the company most, such as customer records or production databases.

Not all data is equal. Naming your crown jewels lets you judge every path by how close it gets to them.

Distance to production is the number of hops that separate an AI agent from a production system.

A short distance means little stands between a mistake and real damage. A long distance gives you more places to stop it.

An IAM role is a set of permissions that an identity can assume to act in a cloud account, often with temporary credentials.

A role is only as safe as who can assume it and what it allows. An execution role for an agent defines how far one compromised agent can go.

Least privilege means giving an identity only the access it needs for its task and nothing more.

Agents are often given broad access because it is faster. Broad access turns a small mistake into a large one.

A managed identity is an identity that Azure creates and rotates for a resource, so no secret has to be stored in code.

It removes the secret that could leak. It still carries permissions, and those permissions can be too broad.

An MCP server is a service that gives AI agents tools and data through the Model Context Protocol, usually with credentials behind it.

Every connected MCP server is a place where authority enters. The agent asks, the server acts with its own credentials.

The Model Context Protocol (MCP) is an open standard that lets AI applications connect to tools and data sources through a common interface.

A shared interface makes it easy to connect agents to many systems. It also makes it easy to connect them to systems nobody reviewed.

A non-human identity is an account that acts without a person: service accounts, API keys, bots, OAuth apps and AI agents.

They outnumber people in most companies and are often owned by no one. They do not take part in the joiner, mover, leaver process that keeps human accounts in check.

An OAuth grant is the permission a user or admin gives an app, often an AI tool, to act in another service.

Grants stay valid until someone revokes them. Each yes to an AI tool leaves a grant behind.

An orphaned account is an identity that still has access but no longer has an owner who answers for it.

Nobody reviews it, nobody removes it, and its access stays valid. Non-human identities become orphaned when the person or team that created them moves on.

Privilege escalation is gaining more access than was intended, often by chaining smaller permissions.

In cloud accounts, a permission to change roles or attach policies can be enough to become an administrator.

Prompt injection is an attack in which text that an AI agent reads, such as a web page or ticket, contains instructions that change what the agent does.

A successful injection can only use the access the agent already has. That makes the agent's reach the limit of the damage.

Secrets sprawl is the spread of credentials across code, tickets, chat and configuration, where nobody tracks them.

Every copy is another place a secret can leak. Agents add more copies, because they need credentials to work.

A service account is a shared identity that software uses to sign in, which AI agents often reuse.

Reuse lets one agent inherit all of an account's access. Service accounts rarely have a named owner and often hold broad permissions.

A service principal is the identity an application uses to access resources in Microsoft Entra ID (Azure).

It is the Azure form of a non-human identity. It holds credentials, such as a secret or certificate, that can expire or leak.

A shadow agent is an AI agent that runs in your environment without an owner or approval on record.

You cannot review the reach of an agent you do not know about. Unowned agents also have nobody to ask when something looks wrong.

Standing privilege is access that an identity holds permanently, whether or not it is currently needed.

Permanent access can be used at any time, by anyone who obtains the credential. It also tends to be forgotten.

A workload identity is an identity assigned to running software, such as a container or function, instead of to a person.

It lets software authenticate without a long-lived password. The access it receives still needs to match what the workload does.