The control model breaks down fast. An agent can mint or publish credentials, another agent can discover and reuse them, and access can spread without human approval or ownership. That creates unsanctioned non-human identities, hidden inheritance of privilege, and a lineage problem that makes incident reconstruction and containment much harder after compromise.
How identity creation turns one agent into a privilege multiplier
When an autonomous agent can create identities, it stops being just a consumer of access and becomes a source of new trust relationships. The practical issue is not only whether the agent can act, but whether it can originate credentials, registrations, or delegated access paths that other actors then accept as legitimate. That changes the control model from single-actor authorization to self-propagating authority.
That shift is dangerous because the new identity may not have a clear owner, review point, or expiry condition. In practice, teams lose the ability to say who approved the identity, why it exists, or whether it still needs to exist. The same problem appears with machine accounts, service principals, API keys, and tokens when creation is automated but governance is not.
Once identity creation is allowed, the question becomes whether the agent is operating inside a bounded lifecycle or outside it. If identity issuance can happen without a human gate, then revocation, attestation, and recertification all become harder, because the control plane no longer has a stable inventory of who or what should exist. For a broad NHI model, that is the point where governance starts to lag behind execution, and NHIMG’s Ultimate Guide to NHIs is a useful anchor for the underlying lifecycle problem.
Why credential sharing creates hidden inheritance and lineage failure
Credential sharing between agents is worse than simple reuse, because it lets access spread without a corresponding ownership chain. One agent can publish a secret, another can discover it, and a third can reuse it later with no durable record of the original authorisation decision. That is how hidden inheritance develops: access appears to be local, but it is actually inherited through an informal distribution path.
This breaks incident reconstruction. If a credential is copied, embedded, cached, or passed along a chain of agents, the defender may see only the last use, not the first issuance or the intermediate transfer. Containment also becomes slower because revoking one credential may not remove all the copies, aliases, or derived permissions that were created from it.
The risk is amplified when credentials are long-lived or reusable across environments. A shared secret that works in one context can become a bridge into others, especially if agents are allowed to consume and redistribute it as part of tool use or workflow automation. That is why credential lifecycle and secret sprawl need to be treated as one control problem, not separate concerns, and the Secret Sprawl Challenge and the static vs dynamic secrets section both map directly to this failure mode.
Where the pattern is already showing up in real incidents, exposure is not theoretical. Credential leakage and secondary reuse are recurring themes in breach analysis, including cases where repositories, chatbots, or misconfigurations exposed tokens that then enabled broader access, such as the New York Times breach and MongoBleed.
What changes operationally when agents can mint and pass on access
Operationally, this is a boundary failure. A system that permits autonomous identity creation and credential sharing needs much tighter rules around issuance, scope, expiry, and observability than a normal automation flow. Without those rules, the environment can accumulate unowned identities, duplicate secrets, and unclear delegation chains faster than teams can review them.
The most important consequence is blast-radius expansion. An agent that can create access for itself and others can convert a single compromise into a distributed compromise, because every shared credential becomes a potential lateral movement path. Even if the original agent is contained, copied credentials may still authenticate elsewhere.
For practitioners, the key operational judgment is that “works technically” is not the same as “is governable.” If a workflow allows an agent to create an identity, then the design must also make that identity observable, attributable, and revocable. If it allows sharing, then the design must assume that every downstream consumer may outlive the original trust decision.
Risk and Threat Considerations
This pattern creates both governance risk and attack-surface risk. The main failure is uncontrolled propagation: one autonomous actor can create a credential, another can inherit it, and defenders lose the ability to distinguish legitimate delegation from silent spread. That makes compromise harder to detect and containment harder to prove.
Failure mechanism: A compromised or overreaching agent mints identities or secrets, distributes them to peers, and leaves behind reuse paths that bypass the original approval boundary.
Impact: Access persists beyond the intended owner, privilege spreads through hidden chains, and incident response has to treat the environment as partially untrusted until the full credential lineage is mapped.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Agent-created identities can outlive ownership and approval. |
| NHI-02 — Secret Leakage | Sharing credentials between agents creates secret exposure and reuse paths. | |
| NHI-05 — Overprivileged NHI | Self-minted identities often inherit more access than they should. | |
| Recommendation — Enforce offboarding and revocation for every autonomous identity as soon as ownership ends. Prevent agents from exposing secrets in logs, stores, or peer-to-peer channels. Constrain agent-issued identities to least privilege and review effective permissions. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Autonomous agents can create identities and propagate access beyond intent. |
| ASI10 — Rogue Agents | Unapproved identity creation and sharing can turn an agent into an uncontrolled actor. | |
| Recommendation — Bind agent actions to explicit identity and privilege boundaries with enforced approvals. Detect and quarantine agents that create or distribute access outside policy. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential creation, sharing, rotation, and revocation are central to the issue. |
| AC-6 — Least Privilege | Shared credentials can expand effective access far beyond intended scope. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Lineage and reuse problems require traceable audit evidence. | |
| Recommendation — Automate lifecycle controls for all authenticators, including issuance and revocation. Limit each agent credential to the minimum privileges required for its task. Log credential issuance and reuse events so downstream sharing is reconstructable. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Shared or minted credentials can undermine trust in who is actually authenticated. |
| API5 — Broken Function Level Authorization | Agent-created access can bypass intended approval and privilege boundaries. | |
| Recommendation — Harden token issuance and reject authentication flows that enable uncontrolled reuse. Enforce function-level authorization on every agent action that creates or distributes access. | ||
Practitioner Guidance
What to verify: Confirm that every agent-created identity has a named owner, an expiry condition, and a revocation path that actually removes downstream copies. If you cannot trace creation to consumer to revocation, you do not have control over the identity.
Decision rule: If an agent can create or share credentials without an explicit approval or policy boundary, treat that as a design defect, not an efficiency gain. Prefer bounded delegation, short-lived credentials, and separate issuance from consumption so the trust chain remains auditable.
Practitioner takeaway: The real control objective is not to stop agents from acting, but to prevent them from becoming uncontrolled identity publishers whose credentials outlive the trust decision that created them.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
