Agentic API Security

It breaks the assumption the whole edifice rests on: a known identity with predictable behaviour on the other end of the call. An agent authenticates perfectly — it holds a valid credential — but it is a goal-seeking system that will call your APIs in whatever sequence, at whatever volume, in whatever combination gets it closer to its objective. So the question shifts from "is this caller who they say they are?" to four: identity, intent, scope, and blast radius. Most estates have solved the first; the other three are where the work is now.

No. An agent wearing a human's credentials is an autonomous system with the full standing access of that person — and an audit log that says the person did it. Agents need machine identities of their own: issued, scoped, and revocable independently of any human, with short-lived tokens and no standing access beyond the task in front of them. Treat an agent identity the way you would treat a microservice you don't fully trust, because zero-trust principles were written for exactly this caller.

Narrow, ephemeral, and task-bound rather than role-shaped. An agent processing refunds gets a credential that can read order history and issue refunds below a threshold — and that is the entire universe it can touch. It cannot read payroll, delete records, or reach endpoints that were never part of the job, and when the task ends the scope ends. Rate limits become a real control at the same time: per-agent quotas, per-endpoint limits, and circuit breakers catch a runaway agent before it empties a table or runs up a bill.

Sort actions by reversibility. Reading data, drafting a message, flagging a record for review — reversible, low blast radius, let the agent run. Issuing a payment, deleting customer data, changing a permission, sending something that cannot be unsent — irreversible, so it routes through a human checkpoint: the agent does the work up to the gate, presents what it is about to do, and waits for a yes. The boundary has to live in the system rather than a policy document, and it starts tight — widen the autonomous lane only as measured performance earns it.

The agent's decisions, not just the HTTP requests. Which agent, which task, which credential, what it asked for, what it got back, what it did next — tied together so a single agent run reads as one coherent trace rather than scattered log lines reassembled mid-incident. This feeds detection, because anomalous agent behaviour looks nothing like anomalous human behaviour, and it decides the aftermath: the difference between a contained incident and a catastrophe is whether "what exactly did it touch?" takes minutes to answer or days.

With the irreversible actions — payments, deletions, anything that touches a customer. Put explicit gates and per-agent scopes around those first: they are the smallest surface and the highest stakes. Then give every agent its own identity, instrument the calls so you can see what they are doing, and tighten outward from there. The mindset shift is the whole thing — stop asking only whether the caller is authenticated, and start asking what it intends, what it is scoped to, and what it can break.