Identity Architecture for Non-Human Actors: Workloads, Agents and Delegated Authority · The Transformed Security Architect: the course

All courses / The Transformed Security Architect / Module 2 / Chapter 8

Learning objectives

After the lesson the participant can:

State the four requirements for workload identity and explain why one identity per workload is the lesson of the July 2026 incident.
Choose between an agent's own identity, delegation and a person's identity for a given action, using the chapter's design test.
Draft an identity record for an agent with scopes, token lifetime, named roles, revocation and review.
Design an approval rule that holds against synthetic media using call-back, dual control and out-of-band confirmation.

Key concepts

Attested workload identity: An identity issued from outside the workload after attesting it from properties of its platform, short-lived and one per workload, so that a log line names exactly one actor and a revocation stops exactly one. SPIFFE and SPIRE are the chapter's reference.
Delegation versus impersonation: In OAuth 2.0 Token Exchange, impersonation makes the holder indistinguishable from the subject, while delegation identifies both and names the acting party in the act claim. The architect requires delegation and prohibits impersonation for agents so the audit trail keeps both visible.
Owner, operators and authority: The three kinds of person behind every machine identity. The owner answers for its existence and purpose, the operators watch it and can revoke its credentials, and the authority approves scope and autonomy level and accepts residual risk, and is never the agent's builder alone.
Approvals that resist synthetic media: Call-back through a contact from a trusted register, dual control by a second approver who did not receive the request, and out-of-band confirmation in an authenticated system of record, bound to changes in who or what may act as well as to payments.
Reconstruction exercise: Take an action from the last quarter at random and trace it to the person who answers for it without asking the agent anything. If the trace stops at an account, a team mailbox or a shared credential, the identity model has a design defect.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Put in order

The machine identity lifecycle

Put the stages of a machine identity's life in the order the chapter describes them.

Interactive exercise 2 · Match

People and approvals behind an identity

Match each role behind a machine identity, and each control for approvals that resist synthetic media, to what it does.

Teaching plan

15 min	Lecture on non-human actors, the failures they share and the four requirements for workload identity; the teacher ties one identity per workload to the shared credential of the July 2026 incident.
10 min	Participants apply the design test to five example actions and choose the agent's own identity, delegation or the person's identity for each.
15 min	Read the identity record HM-EVC-001 and the call-back rule CBR-NR-BEN-01; find the denied permissions, the revocation target and the reason the contact register is fixed at contract signature.
25 min	Exercise: participants register an identity for one agent and run a paper reconstruction of one of its actions back to a named person.
10 min	Debrief on the lifecycle and on the rule that a missed review disables the identity, including who the deputy is where there is a single post.

Discussion

The chapter calls collapsing agent and person into a single identity the most common mistake in AI integrations. Where does that happen in your estate, and whose accountability does it destroy?
At Level 3 Bounded, accountability concentrates on the authority who signs the playbook. How would you explain that to a manager who believes automation spreads the responsibility?
A missed review disables the identity by default. What operational objections would you expect, and how does the chapter's reasoning on improper offboarding answer them?

Written exercise

Exercise · 25 minutes

Register an agent identity

Choose one agent or automated workload that acts in production in your organisation, or use an evidence-collection agent of the kind Hansa Mutual runs. Follow the chapter's practical guide. Write the purpose in one sentence and choose the identity type. List the scopes as resources and actions, each with its autonomy level, starting read-only, and deny by name what an intruder would want most. Set the token lifetime and what the token is bound to. Name the owner, at least two operators and the authority as roles bound to holders, with different people as owner and authority. Define revocation by a path outside the agent's runtime with a target time, the review interval and what happens on a missed review. Then trace one action from token to named person.

Deliverable: An identity record in the form of HM-EVC-001 and a five-step reconstruction trace from one logged action to the person who answers for it.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

What revocation target does the chapter's practical guide set for a Mode 5 agent, by a path outside the agent's runtime?
Show the answer
D. 60 seconds, tested by a revocation test
The guide defines revocation by a path outside the agent's runtime with a target of 60 seconds for a Mode 5 agent, and requires that it be tested; Chapter 10 places the test among the stop paths.
In Nordvik's call-back rule CBR-NR-BEN-01, why is the contact register fixed at contract signature?
Show the answer
B. Because that was the one moment when the Region verified who TriageSoft's people are
The register is fixed at contract signature, the one moment when the Region verified who TriageSoft's people are. Inbound voice, video, email, chat and SMS are all treated as untrusted channels for these changes.
How does the chapter describe the rule that Level 4 Autonomous is never used for irreversible actions, in terms of identity?
Show the answer
A. As a rule of issuance: the broker issues no Level 4 token for an action the register classes as irreversible
The last row of the chapter's table is a rule of issuance, not of intent: the broker does not issue a Level 4 token for an action classed as irreversible, whatever the agent proposes or the owner requests.