Topic starter
18/08/2026 2:42 pm
TL;DR: Bearer tokens and session-scoped API keys break down when the principal is an autonomous agent, because they create ambient authority and weak auditability across tool calls, according to Stacklok. The practical answer is workload identity plus relationship-based authorization, with per-request enforcement that proves who acted, what they touched, and under which policy.
Editorial analysis by NHI Mgmt Group, based on content published by Stacklok: “Agentic Identity Explained: How to Apply SPIFFE and Relationship-Based Authorization to AI Agents in 2026”.
Key questions
Q: What breaks when bearer tokens are forwarded between AI agents?
A: Bearer tokens break down because possession alone becomes enough to reuse access.
Q: Why do per-request checks matter more than session tokens for AI agents?
A: Per-request checks make each tool call the unit of authority, which is necessary when an agent can query databases, invoke APIs and delegate work mid-session.
Q: What are the signs that agent access is too coarse to govern safely?
A: Common warning signs include shared credentials across multiple agents, audit logs that only show a session ID, sub-agents using the root agent's authority and policy checks that happen once at login instead of on each call.
Practitioner guidance
- Define agent identity at the workload layer Use SPIFFE or an equivalent workload identity pattern so each agent instance can prove its runtime identity without relying on static secrets in configuration.
- Move authorisation to each tool invocation Require a policy decision before every MCP or API call so the agent cannot reuse broad session authority across unrelated tasks.
- Model delegation as relationships, not roles Encode user, agent, sub-agent and resource relationships explicitly so the policy engine can evaluate delegated scope and contextual constraints.
Bottom line: AI agents do not fit human-session credential models because the same bearer token can cover many unrelated tool calls without fresh authorisation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:25 pm
Bearer-token authorisation is a human-session assumption, not an agent control model. The article correctly exposes the broken premise: a token issued at session start does not describe the next tool call, the next delegated sub-agent or the next policy context. That makes the control look valid while failing at the point where decisions are actually made. Practitioners need to stop mapping agent runtime behaviour onto human login patterns.
A few things that frame the scale:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: How should teams compare SPIFFE-style workload identity with relationship-based authorisation?
A: SPIFFE-style identity answers who the workload is and whether that identity is verifiable at runtime. Relationship-based authorisation answers whether that verified identity may perform the specific action on the specific resource in the current context. Teams need both because identity proof without policy leaves authority too broad, while policy without identity leaves attribution too weak.
👉 Read our full editorial: SPIFFE and relationship-based authorization for AI agents