What the checklist covers:
30
Pass/fail checks you can run against any agent, on any cloud or framework
6
Control areas, from agent inventory to audit and offboarding
4
Identity-flow patterns compared: pass-through, client credentials, on-behalf-of, and AWS SigV4
1
Question every hop has to answer: which agent is acting, and for whom?
Inside the checklist
Download the checklist to get:
A working document your platform and security teams can fill in together, agent by agent, before a security review.
Download the Checklist✓
The full 30-point agent identity checklist
Every control grouped by area, with what "pass" looks like and who usually owns it.
✓
An identity-flow decision guide
When to forward a token, when an agent should act as itself, and when the next hop needs on-behalf-of token exchange.
✓
A security review worksheet
The questions reviewers ask about agentic IAM, mapped to the evidence you'll need: owners, grants, traces, and revocation tests.
✓
An agent gateway evaluation list
What to look for when choosing where agent authentication and authorization get enforced.
Why it matters
Agent Identity Is Now the Foundation for Agents in Production
Most AI agents today call models, MCP servers, and other agents with shared API keys or static service accounts. When an agent issues a refund or updates a customer record, the log shows a key. It doesn't show which agent acted, and it doesn't show the person the agent was acting for.
That gap gets wider with every hop. A support engineer asks a portal to process a payment. The portal calls an orchestrator agent, which hands the task to a payments agent, which calls the payments MCP server that writes the record. By the last hop, the system of record only sees the agent in front of it. It either trusts everything or trusts nothing.
One request, four hops. The checklist helps you decide what identity each hop should carry.
Teams that try to fix this usually hit the same three walls: there's no identity per agent, user context is lost between hops, and token exchange and refresh logic gets rebuilt inside every agent's codebase. Each one shows up as a blocker at security review.
What good agent identity looks like
Every agent is a first-class non-human identity with an accountable owner. Each hop carries the identity the next system needs, including the user behind the request. Access is allow-listed on both sides of every call and can be revoked on the next request. Every action is traced from the first app to the last tool.
The Agent Identity Checklist turns that standard into 30 checks you can run against each agent you plan to ship. Download it to find the gaps before your reviewers do.
Preview
The six control areas in the agent identity checklist
A sample of the checks in each area. The full checklist adds pass criteria, owners, and evidence for all 30.
Area 1 · 5 checks
Agent inventory and ownership
Every agent is registered in one agent registry, wherever it runs
Every agent has an owner team accountable for it
+3 more checks
Area 2 · 5 checks
Identity issuance
Each agent has exactly one identity, with no shared keys
Identities are issued by your IdP (Okta, Entra, OIDC, SPIFFE/SPIRE) or the gateway
+3 more checks
Area 3 · 6 checks
Agent authentication across hops
The identity flow for each hop is chosen deliberately
The system of record can see the user an agent acts for
+4 more checks
Area 4 · 5 checks
Agent authorization
An allow-list controls who can call each agent
Each agent can reach only the models, MCP servers, and agents it needs
+3 more checks
Area 5 · 5 checks
Observability and audit
Every trace names both the agent and the user behind it
Agent, model, and tool calls appear in one trace
+3 more checks
Area 6 · 4 checks
Lifecycle and revocation
Removing a grant blocks the very next call
Retired agents are offboarded and their identities revoked
+2 more checks
4.7
★★★★★
Gartner Peer Insights
Rated 4.7 on Gartner Peer Insights
Platform teams run TrueFoundry's AI Gateway for LLM, MCP, and agent traffic in production. Agent Identity runs on that same gateway, with the same RBAC, guardrails, and traces.
96%
of reviewers likely to recommend
4.9
ease of deployment and admin
3–4 ms
added gateway latency
