Why does an AI agent need its own service account?
An AI agent needs its own service account so its work is attributable and its access can be changed without affecting a human user. Sharing one person's token or one global agent key obscures which automation acted and increases the impact of credential leakage.
How should an agent service account be scoped?
Scope the identity to one agent, one operational purpose, and the smallest set of workspaces and actions it needs. Separate read-only retrieval from publishing or administration when those functions have different risk, and do not grant company-wide access merely because setup is easier.
- Name the agent, owner, purpose, environment, and expiry or review date.
- Grant only the spaces and operations required by the workflow.
- Keep production and test agents on separate credentials.
- Review recent use before rotating, disabling, or deleting the identity.
Where should the credential be stored?
Store the credential in the host's secret store, environment, or managed workload identity system. Never place it in a prompt, handover artifact, repository, chat transcript, screenshot, or copied MCP configuration that may be shared.
How does service-account access work with MCP?
A remote MCP server can use OAuth for interactive people and a bearer credential for unattended service identities. The server must validate the token for its own resource, map it to a principal and scopes, and enforce the same authorization rules on every tool call.
How should agent actions be audited?
Audit records should include the service identity, operation, target workspace or record, timestamp, result, and resulting revision. A service identity should not be able to override authorship with a request field, because caller-controlled attribution makes the audit trail unreliable.
How should a service account be retired?
Disable the identity first, verify that no workflow still depends on it, then revoke or delete the credential after a defined observation period. Preserve historical authorship so old revisions continue to identify which agent created them.
Primary references