An agent identity model where the action is tied to a shared workspace or channel rather than to the human requester. It preserves a distinct non-human identity for the agent, but moves accountability and authorization into the compartment, which changes how audit, access and offboarding are governed.
What Compartmentalised Agent Identity Means
Compartmentalised agent identity separates the agent’s non-human identity from the human requester, so the agent operates within a shared compartment such as a workspace or channel. The compartment becomes the unit of accountability, access and audit rather than the individual request originator.
This model is useful when an agent needs to act continuously across multiple interactions, but organisations still want a stable boundary for permissioning and recordkeeping. It is not the same as simply letting a bot “help out” in a thread, because the compartment has to define what the agent may see, do and retain.
How the Compartment Changes Authorization
The key security shift is that authorization is expressed against the compartment, not a one-off human request. That makes the compartment a control surface for delegated authority, shared context and scoped access, so the design must be explicit about who can open, join, observe or administer it.
Because the agent identity remains distinct, the compartment can preserve continuity without tying every action to a transient user session. This is where the model differs from ad hoc impersonation: the agent still has its own identity, but its operational authority is mediated by the compartment’s rules and lifecycle.
In practice, this pushes teams toward clearer boundaries between the human principal, the agent principal and the workspace principal. It also creates a cleaner place to attach logging, approval policy and retention rules when the agent’s work spans multiple turns or tasks.
Audit, Traceability and Offboarding Implications
Compartmentalised identity changes what must be recorded in audit trails. Reviewers need to see which compartment authorised the action, which agent instance performed it and which human or process sponsored the compartment, otherwise accountability becomes blurred even if the action itself is technically permitted.
The same model also changes offboarding. If the compartment outlives the user, the organisation must decide whether the agent stays active, whether its access is reduced, and what happens to any shared context, tokens or retained state associated with that compartment.
This matters because compartment-level persistence can outlast the original business need. If cleanup is weak, a dormant compartment can become an enduring access path even when the human requester has left, changed role or no longer has a legitimate reason to supervise the agent.
When Compartmentalised Identity Is the Right Pattern
This pattern works best when an agent is expected to collaborate over time inside a bounded work area, such as a project channel, case workspace or operational queue. It is less suitable when every action should be tightly attributable to an individual person in real time.
The design trade-off is between continuity and direct per-user attribution. A compartment can reduce friction and improve operational coherence, but it only remains safe if the organisation treats the compartment itself as a governed identity boundary with explicit ownership, limits and retirement criteria.
Agentic AI Identity Guide provides the broader identity model for how AI agents get, use and lose identities, including delegation and retirement. For compartment-level governance, that framing is the most direct way to understand why the workspace, not just the requester, becomes the security boundary.
Risk and Threat Considerations
Compartmentalised identity can concentrate risk if the workspace becomes a durable access container with broad trust. If the compartment is over-permissioned or poorly retired, an attacker who reaches the agent or the shared channel may inherit access that was meant to be temporary or narrowly scoped.
Failure mechanism: Weak compartment ownership, excessive shared access or incomplete offboarding allows the agent’s retained authority and the workspace’s trust boundary to outlive the original task, creating a persistent abuse path.
Impact: That can lead to unauthorized action, difficult-to-reconstruct audit trails, stale access after role changes, and unintended exposure of data or tools that were supposed to remain compartmentalized.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Compartmentalized agent identity centers on delegated authority and scoped agent access. |
| ASI10 — Rogue Agents | The term depends on controlling which agent instance can act inside a shared compartment. | |
| Recommendation — Constrain agent authority to the compartment and verify privilege boundaries before allowing tool or workspace access. Tie each agent to a governed compartment and revoke its access immediately when the workspace is retired. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The model is about reducing excess authority for a non-human agent inside a shared workspace. |
| Recommendation — Review compartment permissions for least privilege and remove any agent access that exceeds the task scope. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Compartment authority should be minimized to the actions required within the shared workspace. |
| AU-2 — Event Logging | Auditability is central because compartmentalized identity shifts accountability into the workspace boundary. | |
| Recommendation — Apply least privilege to the compartment so the agent can only perform the actions the workflow requires. Log compartment membership, agent actions and administrative changes so the authority trail remains reconstructable. | ||
Practitioner Guidance
Governance implication: Treat the compartment as a first-class identity boundary, not a convenience layer around a human request. Define who owns it, who can administer it and what event retires both the agent’s access and the compartment’s retained state.
What to watch for: Long-lived workspaces, shared channels with broad membership and agent permissions that exceed the narrow purpose of the compartment are the clearest signs that the model is drifting away from its intended control boundary.
Practitioner takeaway: The compartment should be the smallest durable unit of authority that still supports the work, because anything larger becomes a hidden privilege domain.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org