Securing AI Agents with Ephemeral, Task-Scoped Credentials

Stop Credentialing Your AI Agents Like It’s 2019

T Devon Artis introduces the broker model for AI agents to solve the critical mismatch between ephemeral compute and long-lived security credentials. A 2-minute agent run backed by a 60-minute OAuth token results in an exposure window 30 times longer than necessary.

Why This Matters

In 2026, the first year of large-scale agent deployment, teams face a choice between managing identity sprawl or preventing it. Most teams currently use credentials that outlive the work, such as 60-minute OAuth tokens for 2-minute tasks, creating a massive attack surface where stolen credentials remain useful long after the agent has finished its work.

The broker model provides a technical path to enforce the principle of least privilege dynamically, ensuring credentials die with the task. This prevents the accumulation of thousands of stale identities and ensures that delegation chains preserve authority rather than expanding it, reducing the need for costly periodic access reviews and entitlement audits.

Key Insights

• 2026 marks year one for AI agent deployment at scale, requiring immediate architectural shifts toward ephemeral identity (Source: Artis, 2026).
• The 30x exposure gap exists when 2-minute agent tasks are backed by standard 60-minute OAuth tokens, a common but dangerous mismatch.
• AgentWrit provides a self-hosted Go broker to issue task-scoped tokens, ensuring agents only access specific resource IDs.
• Delegation chain verification ensures that when Agent A authorizes Agent B, permissions are preserved or reduced, never expanded.
• Architectural alignment with OWASP Agentic Top 10 (2026) and NIST IR 8596 provides a standardized framework for agentic security.

Working Examples

Implementation of a task-scoped broker agent that requests specific customer access and releases the credential immediately upon task completion.

from agentwrit import AgentWritApp, validate
from agentwrit.errors import AuthorizationError

app = AgentWritApp(
    broker_url=os.environ["AGENTWRIT_BROKER_URL"],
    client_id=os.environ["AGENTWRIT_CLIENT_ID"],
    client_secret=os.environ["AGENTWRIT_CLIENT_SECRET"],
)

try:
    agent = app.create_agent(
        orch_id="billing-agent",
        task_id="billing-12345",
        requested_scope=["read:data:customer-12345"],
    )
except AuthorizationError as e:
    raise

resp = httpx.get(
    "https://api.example.com/customers/12345/billing",
    headers=agent.bearer_header,
)

# Immediate revocation
agent.release()

Practical Applications

• MedAssist clinical assistant: Spawns agents scoped to specific patient IDs. Pitfall: Shared service accounts allow compromised agents to access all patient records.
• Support Tickets pipeline: Three-agent flow where triage cannot escalate to delete_account tools. Pitfall: Broad IAM roles allow triage agents to execute destructive actions.
• Multi-agent delegation: Agent A passes signed tokens to Agent B. Pitfall: Credential sharing between agents leads to trivial privilege escalation across the pipeline.

References:

• https://github.com/devonartis/agentwrit
• https://github.com/devonartis/agentwrit-python
• https://github.com/devonartis/AI-Security-Blueprints