UiPath Agentic Automation Security Guide: Securing Robots, Agents and Orchestrator Credentials

A UiPath estate that adds AI agents and Maestro processes to existing robots multiplies its non-human identities: robot accounts, machine client secrets, external application secrets, Integration Service connections and Orchestrator credential assets, each able to reach business systems without a person signing in. This guide explains how identity and secrets work across UiPath Automation Cloud, Orchestrator, Agents and Maestro, and which customer-side settings decide how well they are protected. It covers robot authentication, robot accounts and folder roles, credential assets and external credential stores, external applications, AI Trust Layer policies and guardrails for agents, Maestro execution permissions, and audit logging. It is written for automation centre of excellence leads, platform administrators and identity and security teams who own a UiPath tenant. For the vendor-neutral view of bot identity, start with the RPA and Bot Identity Security Guide; this page goes deeper on UiPath settings.

This is an independent guide from NHI Mgmt Group, based on UiPath's public documentation as of November 2026. It is not sponsored or reviewed by UiPath. Product features change, so confirm settings against UiPath's current documentation.

Key takeaways

• Use expiring tokens for every robot. UiPath recommends client credentials (OAuth 2.0 client ID and secret from a machine template) for unattended robots and Interactive Sign-in SSO for attended robots; machine keys issue non-expiring tokens and UiPath has announced they will be deprecated.
• Robot accounts are your service accounts. UiPath describes robot accounts as its RPA-specific equivalent of service accounts; give each automation its own, assign it explicitly to only the folders it needs, and keep roles minimal.
• Keep passwords out of workflows. Store logins as Credential assets (AES 256 encrypted in the Orchestrator database) or, on Enterprise plans, resolve them from an external credential store such as Azure Key Vault, CyberArk or HashiCorp Vault.
• Govern agents with an AI Trust Layer policy. Deploy a policy that sets which models agents may call, turns on centralised guardrails such as Prompt Injection and In Flight PII, and decides audit and trace retention.
• Export audit logs before they age out. Classic and new audit logs have defined retention, and Orchestrator keeps robot logs for at most 31 days; send them to your own log platform for investigations.

How identity works across UiPath robots, agents and Maestro

UiPath's Automation Cloud admin guide defines three account types that matter here. User accounts identify people, either local users or directory users from a linked directory such as Microsoft Entra ID. Robot accounts are non-user identities for unattended back-office processes: they behave like user accounts for permissions and can join groups, but they need no email address and cannot have interactive process configuration. External applications are OAuth clients registered by an administrator to call UiPath APIs. Groups bundle accounts that need the same roles, licences and robot configuration; an account in several groups receives the combined permissions.

Agents and Maestro build on these identities rather than replacing them. Agents call business applications through Integration Service connections and run work through Orchestrator. Maestro Orchestrate, which UiPath describes as a cloud-native platform that orchestrates AI agents, robots and people across end-to-end processes, needs at least one user or robot account enabled for Unattended, assigned to the tenant and added to the target folder when it invokes RPA workflows.

For how these patterns compare with agent identities in general, see the Agentic AI Identity Guide.

Robot authentication and machine credentials

Orchestrator authenticates each robot before granting access to resources. The method is set at Tenant > Settings > Robot security > Robot authentication, separately for attended and unattended robots.

• Move off machine keys: machine keys produce tokens that never expire, so a copied key keeps working until someone notices. Use the deprecation alerts as your inventory of machines still to migrate, then switch the tenant from Hybrid to the recommended methods.
• Treat client secrets as privileged credentials: store them in your secrets manager, deploy them through your configuration management rather than by hand, record which machine template each belongs to, and rotate them on a schedule by generating a new secret, updating robots, then deleting the old one. See the Secrets Management Guide.
• Bootstrap carefully: the client secret is the robot's first secret, so protect the host it sits on. The Secrets Zero Problem Guide covers the patterns.

Robot accounts, folders and least privilege

Folders are the main boundary in Orchestrator: assets, processes, queues, connections and jobs belong to folders, and roles are granted per folder. UiPath's guidance on robot accounts includes one detail that catches many teams: if only robot account groups are assigned to a folder, individual robot accounts cannot run jobs there, so each robot account must be assigned to the folder explicitly.

1. One robot account per automation or business service: shared robot accounts make audit trails ambiguous and widen the impact of any compromise. Name accounts so the owning process and team are obvious.
2. Folder per trust zone: separate finance, HR and customer-data automations into different folders, so a credential asset or connection in one is unreachable from the others.
3. Start from built-in roles and trim: UiPath's Maestro prerequisites start from the built-in Automation User role and add only what is needed, for example Triggers.view and Triggers.create for wait-for-trigger steps and Logs.view where operators need logs. The same documentation lists permissions that Case execution does not need, including Jobs.delete, Processes.edit and create, edit or delete on Assets, Queues, Connections and Storage Buckets.
4. Use groups for the common case: UiPath recommends groups for accounts with the same needs and direct role assignment only for exceptions; directory groups from Entra ID keep joiner, mover and leaver changes in one place.
5. Review the default robot account: each new organisation gets a default robot account added to the Automation Users group. Decide whether you use it and, if not, remove its folder assignments.
6. Recertify quarterly: review robot account folder assignments and roles alongside human access reviews.

Credential assets and external credential stores

Orchestrator assets hold values that workflows request by name with the Get Asset or Get Credential activity; a robot receives the value only if the name matches and it has the required permissions. UiPath documents six asset types: Text, Bool, Integer, JSON, Credential (usernames and passwords for target applications) and Secret (API keys, used by coded agents). All asset types are encrypted in the Orchestrator database by default, Credential and Secret assets use AES 256, and developers can reference them in process design without seeing their values.

• Scope values: an asset can have a global value, a value per account or a value per account-machine pair (robots v20.10 or newer). Use per-account values so each robot account gets its own target-system login rather than one shared password.
• Pick a credential store: the Orchestrator Database store is built in. UiPath also lists CyberArk CCP, CyberArk Conjur and Conjur Cloud (read-only), Azure Key Vault, HashiCorp Vault, BeyondTrust Password Safe, Thycotic Secret Server, Delinea Secret Server (read-only), AWS Secrets Manager and Google Secret Manager, several in read-only variants.
• Prefer read-only stores where rotation is owned elsewhere: with a read-only store, the vault remains the source of truth and its own rotation and approval workflows apply; Orchestrator retrieves the value at run time by the asset's External Name.
• Grant the store narrow rights: UiPath documents that an Azure Key Vault service principal needs Key Vault Secrets Officer or Key Vault Administrator, and that a HashiCorp Vault policy must grant read on the resolved data path (plus create, update and delete for read-write). Scope that identity to a dedicated vault or path for UiPath only.
• Test after creating a read-only HashiCorp store: UiPath notes that creating it does not test the connection, and path or permission errors show only when a robot first requests a credential.
• Limit store folder access: stores apply to all folders by default and can be limited to selected folders.

Availability: UiPath states that third-party credential stores require an Enterprise-tier licensing plan. Changing the default store does not move existing assets or robot credentials, which keep the store they were created in, so plan a migration for older items.

External applications and API access

External applications let scripts, CI/CD pipelines and other platforms call UiPath APIs. An administrator registers each one as confidential (receives an app secret and can use application scopes) or non-confidential (cannot store a secret and cannot use application scopes). User scopes act in a signed-in user's context and need a redirect URL; application scopes act without user interaction.

• Prefer user scopes for tools people drive: a non-confidential app with user scopes cannot act beyond the signed-in user's permissions.
• Keep application scopes minimal: scopes are added one resource at a time, so grant only the resources the integration uses and review them when the integration changes.
• Capture the secret once, into a vault: UiPath shows the app secret once at registration. Store it directly in your secrets manager. Generating a new secret breaks the integration until it is updated, so rotate during a planned change.
• Keep a register: record owner, purpose, type, scopes and secret creation date for every external application, and delete unused secrets from the External Applications view.

For scope design principles, see the OAuth Scope Design Guide.

Securing UiPath agents with the AI Trust Layer

Agent governance in UiPath is set through two Automation Ops policies. The AI Trust Layer policy controls tenant access to Agents, guardrails on agent LLM calls and which models agents can use. The Studio Web policy sets design limits that an agent must meet before publishing, enforced at design time and at runtime. An AI Trust Layer policy can be deployed at tenant, group or user level and takes effect only where deployed; UiPath notes changes can take up to five minutes to apply.

Agent tools that call Integration Service activities can take input from the prompt (the agent infers the value), from an argument passed in by a workflow, or from a static value. Use arguments or static values for fields that control what the tool touches, such as target project, record type or recipient, so a prompt injection cannot redirect the action. This limits the excessive agency risk OWASP lists as LLM06:2025, and indirect prompt injection, which ATT&CK v20 tracks as T1698. See the Human-in-the-Loop for AI Agents Guide and the AI Guardrails and AI Firewalls Guide.

Maestro processes and execution permissions

Maestro Orchestrate coordinates agents, robots and people in BPMN, Case and Flow processes, with business rules in DMN and live supervision (pause, resume, retry) of process instances. From a security view it is a chain of delegated authority: the process starts jobs as a robot or user account, the job reads assets and connections in its folder, and agents in the process call tools.

• Dedicated runtime identity: give each agentic process its own unattended robot account in its own folder, so its assets and connections are not shared with unrelated automations.
• Read-only asset access for operators: UiPath's Case execution permission set includes Assets.view and Connections.view and excludes create, edit and delete on Assets and Connections. Keep it that way for operators.
• Separate builders and runners: Processes.edit is not needed for execution. Grant it only to builders, in personal workspaces or development folders.
• Human tasks as control points: place approval steps before payments, data deletion or external communications, and make sure the approving group is not the same as the builders.

Logging, detection and measurement

UiPath keeps audit logs at organisation level (identity, directory sync, user and group administration, organisation settings) and tenant level (roles, services, tenant settings, access policies). The new unified audit experience covers services including Access Policy, Authorization, Automation Ops, Integration Service, AgentHub and Licensing, with filtering by user, source, category, action, status and IP address.

What to alert on: new external applications or new secrets on existing ones; changes to robot authentication settings; robot accounts added to folders or given new roles; credential store creation or default store changes; AI Trust Layer policy edits, especially guardrails turned off or new model providers allowed; and "Machine key authentication deprecated" alerts. See the SIEM Log Source Onboarding Checklist.

Metrics:

• Percentage of robots on client credentials or Interactive Sign-in SSO (target 100%).
• Percentage of credential assets resolved from an external store rather than the Orchestrator database, where you have an Enterprise plan.
• Robot accounts assigned to more than one trust-zone folder (target zero without a documented exception).
• External application secrets older than your rotation period.
• Agent tenants with Prompt Injection and In Flight PII guardrails on.
• Days of audit history held in your own SIEM.

Framework mapping

Common misconfigurations

• Hybrid robot authentication left on indefinitely: machines keep non-expiring machine keys long after migration was planned. Set a date and switch to the recommended methods.
• One robot account across many folders: a single identity can read every credential asset in every folder it is assigned to. Split by trust zone.
• Global asset values for shared logins: every robot uses the same target-system password, so rotation is disruptive and audit trails in the target system show one user. Use per-account values.
• External application secrets with no owner: integrations outlive the people who registered them. Keep a register and review it quarterly.
• Agents enabled tenant-wide before policy: Enable Agents is on by default. Deploy an AI Trust Layer policy with guardrails and model restrictions before builders publish agents to production.
• Relying on in-product log retention: robot logs are held for at most 31 days, which is shorter than many investigations. Export continuously.

Apply UiPath security updates promptly for self-hosted components such as robots and Studio.

Practitioner checklist

• Set Robot authentication to client credentials (unattended) and Interactive Sign-in SSO (attended), and clear every machine key alert.
• Store and rotate machine template client secrets in your secrets manager.
• Give each automation or agentic process its own robot account, assigned explicitly to only the folders it needs.
• Move target-system logins into Credential assets with per-account values, and to an external credential store where your plan allows.
• Register external applications with minimal scopes, vault the secret at creation and keep an owner register.
• Deploy an AI Trust Layer policy: approved models only, Auto allow new models off, Prompt Injection and In Flight PII guardrails on, deliberate audit and trace retention choices.
• Require a Human In the Loop escalation in the Studio Web policy for agents that take consequential actions, and fix sensitive tool inputs as arguments or static values.
• Grant Maestro operators the Case execution permission set without edit rights on assets and connections.
• Export organisation, tenant, unified audit and robot logs to your SIEM and alert on identity and policy changes.
• Recertify robot accounts, external applications and connections every quarter.

Standards and references

• UiPath: Robot authentication
• UiPath: About assets
• UiPath: Managing credential stores
• UiPath: Managing external applications
• UiPath: Settings for AI Trust Layer policies
• UiPath: Agents governance
• UiPath: Maestro prerequisites
• UiPath: About logs

Related NHI Mgmt Group resources: RPA and Bot Identity Security Guide · Secrets Management Guide · Agentic AI Security Guide · Human-in-the-Loop for AI Agents Guide