# AI agent IAM reference architecture workbook

Version: 1.0  
Freshness date: 28 July 2026

Use this workbook to design and review one AI-agent authority path. Replace every example value with
your organization’s approved identity, entitlement, policy, approval, incident, and evidence
contracts.

## 1. Identity inventory

| Identity | Stable ID | Issuer or owner | Tenant or trust domain | Credential class | Expiry | Revocation owner | Evidence source |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Human user |  |  |  |  |  |  |  |
| Delegated user |  |  |  |  |  |  |  |
| Agent |  |  |  |  |  |  |  |
| Workload |  |  |  |  |  |  |  |
| Service |  |  |  |  |  |  |  |
| Tool or resource server |  |  |  |  |  |  |  |
| Reviewer |  |  |  |  |  |  |  |

## 2. Authority record

- Sponsoring principal:
- Agent identity:
- Workload identity:
- Delegated subject:
- Delegation or assignment ID:
- Approved purpose:
- Tool:
- Resource:
- Data boundary:
- Action:
- Amount or exposure limit:
- Environment:
- Effective time:
- Expiry:
- Required policy:
- Approval rule:
- Reviewer role:
- Tenant and organization boundary:
- Credential audience:
- Evidence record:

## 3. Entitlement review checklist

### Population and ownership

- [ ] Reconcile every registered agent, workload, service account, MCP client, tool credential,
      delegated session, and reviewer role to an owner.
- [ ] Compare the identity inventory with cloud principals, token-issuer records, gateway traffic,
      secret stores, CI/CD identities, MCP discovery, package spend, and observed tool calls.
- [ ] Record orphaned, shared, dormant, duplicate, and unobserved identities as exceptions.
- [ ] Assign a review owner, revocation owner, evidence owner, and due date to each exception.

### Effective authority

- [ ] Reconstruct effective access from direct grants, roles, attributes, relationships,
      capabilities, inherited groups, delegations, temporary grants, policy rules, and downstream
      service permissions.
- [ ] Test agent, tool, resource, data, action, purpose, amount, environment, and time dimensions.
- [ ] Confirm every credential is audience-bound to the intended resource.
- [ ] Confirm the agent cannot expand its own permissions or approve its own request.
- [ ] Verify the effective authority is narrower than the sponsoring user’s ambient access when the
      task permits it.

### Runtime enforcement

- [ ] Test one allowed request, one approval request, one blocked request, one expired request, and
      one request with missing context.
- [ ] Verify connectivity and successful authentication never bypass authorization and policy.
- [ ] Verify the approval binds the exact action, parameters, destination, evidence, policy version,
      and expiry.
- [ ] Reconcile each test to the downstream system and the audit event.

### Lifecycle and revocation

- [ ] Confirm short-lived credential issuance, refresh, rotation, expiry, and revocation behavior.
- [ ] Revoke one user assignment, agent identity, workload identity, delegation, tool grant, and
      reviewer role, then test residual access.
- [ ] Exercise emergency stop, queued-work cancellation, in-flight work, downstream containment,
      Rollback, compensation, and controlled restart.
- [ ] Measure the last accepted side effect after the stop command.

### Certification record

- [ ] Record criteria, population, period, reviewer, sample, exceptions, compensating controls,
      decision, expiry, and next review.
- [ ] Attach immutable identity, token, authorization, policy, approval, execution, revocation, and
      evidence references.
- [ ] State exclusions and unresolved gaps.

## 4. Entitlement lifecycle decision table

| Dimension | Owner | Decision point | Review | Revocation | Minimum evidence |
| --- | --- | --- | --- | --- | --- |
| Agent | Agent owner | Identity binding | Agent inventory review | Disable agent and deny new sessions | Agent ID, owner, Release, state |
| Tool | Tool owner | Tool gateway | Tool grant review | Remove grant and deny tool calls | Tool ID, version, grant, result |
| Resource | Resource owner | Resource server | Resource ACL review | Remove resource grant | Resource ID, tenant, authorization result |
| Data | Data owner | Query or data gateway | Data Boundary review | Remove field or dataset access | Boundary, fields, purpose, result |
| Action | Process owner | Pre-side-effect gate | Action matrix review | Deny action type | Action, parameters, reason code |
| Purpose | Business owner | Delegation and policy gate | Purpose review | End mandate or delegation | Purpose, sponsor, effective dates |
| Amount | Risk owner | Transaction policy gate | Threshold review | Lower limit or block band | Value, currency, aggregate, decision |
| Environment | Platform owner | Token issuer and deployment gate | Environment review | Remove production trust or grant | Environment, workload, audience |
| Time | IAM owner | Token issue and request gate | Expiry review | Expire token, session, or grant | Issued, effective, expiry, revoke time |

## 5. Deployment-pattern decision table

| Pattern | Use when | Required controls | Main risk | Selection rule |
| --- | --- | --- | --- | --- |
| Dedicated agent identity | Repeatable operational work has enterprise-owned authority | Agent and workload IDs, task scopes, owner, short-lived credential, policy gate | Standing privilege or orphaned identity | Default for production automation with repeatable authority |
| Delegated user identity | One named user requests a bounded action inside their own authority | Subject and actor binding, purpose, scope reduction, expiry, consent or assignment | Ambient user privilege and weak attribution | Use when the user remains the authority owner for the action |
| Hybrid actor and subject | A dedicated agent acts for one user | Independent agent identity plus delegated subject, token exchange, two-party evidence | Confusing actor with subject | Use when both identities change the authorization decision |
| Service-mediated execution | A gateway holds downstream credentials and enforces every call | External gate, per-request policy, credential broker, receipt reconciliation | Gateway bypass or shared credential | Use when target systems cannot issue agent-specific credentials |
| Ephemeral task identity | High-scale jobs need isolation per run | Workload attestation, short lifetime, task binding, no refresh beyond task | Identity explosion and incomplete inventory | Use when issuance and evidence are automated end to end |
| Cross-organization federation | The agent and resource belong to different authorities | Qualified trust, issuer mapping, local policy, tenant binding | Foreign role or attribute over-trust | Use with explicit bilateral trust and agreed semantics |

## 6. Reusable least-privilege policy

Download the JSON policy at:

https://kla.digital/downloads/ai-agent-least-privilege-policy.json

The example covers all nine entitlement dimensions and uses synthetic credit-review identifiers. Its
scope is a vendor-neutral design template. The current KLA API contracts are documented separately.

## 7. Worked regulated example

A bank assigns a credit-review agent to case `CR-1842`. The agent uses a dedicated workload identity
and a 15-minute token. A named underwriter is the delegated subject for this case. The token audience
is the document service. Policy allows four approved fields for the purpose
`credit_application_review`, inside production, while the assignment remains active.

The agent reads those fields and drafts a memo. Authorization permits amounts up to EUR 100,000.
A proposed credit decision and any amount above EUR 25,000 require a Decision Request. Amounts above
EUR 100,000, forbidden fields, and changes to the authorized purpose or destination block. Approval
operates inside the authorization ceiling. The underwriter who requested the case cannot decide
that request. A qualified second reviewer receives the action, policy reasons, current source
evidence, expiry, and expected downstream effect.

Approval releases the same bound request once. The downstream receipt and resulting case state join
the identity, delegation, entitlement, policy, reviewer, and execution records. Removing the case
assignment expires the delegation, revokes its task credential, denies later calls, and records any
residual access.

## 8. Review record

- Review date:
- Scope:
- Population:
- Reviewer:
- Criteria:
- Samples:
- Exceptions:
- Decision:
- Expiry:
- Next review:
- Evidence bundle:
- Follow-up owner: