What a first-class agent identity actually is, and whether it is just workload identity

This post defines a first-class agent identity as a stable runtime principal with its own scoped permissions, a clear owner, and an independent kill switch. It contrasts this with common alternatives like shared service accounts, per-user impersonation, and static secrets, highlighting their shortcomings. The post then explores the conditions under which agent identity collapses into workload identity, based on three invariants: a one-to-one mapping between agent and workload, a registry as the source of truth, and identity continuity across restarts. It observes that public platforms like Microsoft Entra Agent ID and AWS Bedrock AgentCore implement a layered approach where agent identity sits above workload identity when these invariants break, typically within a single control plane and trust domain. The takeaway is to audit agents against these invariants to determine the need for an extra identity layer.