Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Audit an autonomous agent as a real identity, not as a prompt. Give it a unique principal and accountable owner, inventory every credential and effective permission, map each workflow to the smallest required tool and resource scope, and enforce those limits at the gateway or tool-execution boundary. Then test expiry, rotation, and revocation end to end and retain logs that prove who authorized each action. This approach reveals hidden inherited access, stale tokens, and privilege paths that a simple role review misses.
What must an autonomous-agent permission audit prove?
An audit should answer five questions with evidence: which identity acted, who owns it, what it was allowed to do, what it actually did, and how quickly access can be stopped. The review covers the orchestrator, model runtime, plugins, tool servers, API gateways, identity systems, secret stores, and downstream applications. Treat production, staging, and experimental agents as separate subjects even when they run the same model.
As an Amazon Associate I earn from qualifying purchases.
Microsoft guidance calls for a dedicated agent identity, a named owner or sponsor, a documented purpose, approved data access, tool dependencies, and an identified environment. Joint guidance from CISA and partner agencies emphasizes limiting autonomy and avoiding broad or unrestricted access to sensitive data or critical systems. Those principles make ownership and scope the starting point, not an afterthought.
- Identity: a unique workload, service-account, delegated-user, or agent-specific principal can be traced to one owner and purpose.
- Effective authorization: inherited roles, groups, delegated context, plugin grants, and downstream checks are evaluated together.
- Credential lifecycle: issuance, storage, use, expiry, rotation, exchange, and revocation are observable and testable.
- Runtime control: every tool and operation is denied by default unless an explicit policy permits it.
- Evidence: approvals, exceptions, tests, alerts, and remediation records can be correlated to the action they concern.
How do I define the audit scope and risk?
Start with a written inventory of every agent and the systems around it. Include an agent that is disabled but still has credentials, because dormant access can become an incident when a deployment or schedule reactivates it.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
List agents, environments, and owners
- Record the agent name, unique principal, business purpose, named owner, incident contact, and lifecycle status.
- Separate production, staging, development, research, and personal environments. Do not treat an environment label as proof that credentials are isolated.
- List the model runtime, orchestrator, plugins, tool servers, queues, databases, SaaS APIs, file stores, and other downstream systems the agent can reach.
- Classify the data each path can expose or change, such as public, internal, confidential, regulated, or financial.
- Mark irreversible or high-impact actions: deleting data, sending messages to external recipients, changing permissions, deploying code, purchasing, or moving funds.
- Record the escalation path and the person who can disable the agent, revoke credentials, and approve an emergency exception.
Assign risk before inspecting permissions
Risk is driven by impact and autonomy, not by the agent’s label. An agent that can only read a low-sensitivity document repository has a different review depth from one that can publish customer communications or alter access-control policies. Note whether actions are reversible, whether a human must approve them, and whether the agent can create or exchange credentials. Use those factors to prioritize testing and monitoring; there is no universal review interval that fits every deployment.
What belongs in an agent identity and token inventory?
Build one record per principal and per credential. A single agent may use a workload identity for one tool, a delegated user token for another, and a signing key for a third. Capture all of them instead of assuming that the most visible API key is the whole identity.
| Inventory area | Record | Why it matters |
|---|---|---|
| Principal and ownership | Unique identity, owner or sponsor, purpose, environment, deployment and incident contacts | Provides accountability and prevents an orphaned agent from retaining access |
| Token and proof | Issuer, token type, signing or proof method, audience, scopes, roles, claims, resource and tenant restrictions | Shows what a relying service can verify and where the credential is valid |
| Lifecycle | Issue, expiry, last-used, rotation, exchange, and revocation timestamps | Exposes long-lived, unused, or overdue credentials |
| Storage | Managed vault, workload-identity binding, environment variable, file, CI secret, cache, prompt, or process memory | Identifies leak and extraction paths |
| Credential administration | Principals allowed to mint, exchange, delegate, rotate, or revoke | Reveals who can create a broader credential or bypass an owner |
| Evidence links | IAM policies, secret-management records, deployment manifests, approvals, and prior test results | Lets a reviewer reproduce the authorization decision |
OWASP guidance advises against long-lived credentials in process environments, prompts, or configuration files. Prefer task-scoped, short-lived credentials issued just before a task and discarded afterward. NIST IR 8587 addresses token verification, key management, lifecycle controls, and monitoring; use it to check that issuers and relying services agree on validation rules.
Find credentials that an agent can mint
Inspect token-exchange, impersonation, federation, signing-key, and secret-manager permissions. A read-only data grant can become administrative if the same identity can mint a token with broader scopes. Record every principal that can create, exchange, delegate, rotate, or revoke the agent’s credential, then test whether those powers are limited to the intended audience and resource.
How do I reconstruct effective permissions instead of assigned roles?
Assigned roles are only inputs. Effective access is the result after inheritance, group membership, delegated user context, agent-to-agent trust, plugin permissions, resource policies, and downstream authorization checks are combined.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Export role bindings, group membership, policy documents, resource ACLs, and trust relationships for the agent and every service it can call.
- Resolve inherited permissions from folders, projects, subscriptions, organizations, tenants, and shared service accounts.
- Follow delegated-user context through the entire call chain. Note whether a downstream service authorizes the human, the agent, or both.
- Map plugin and tool permissions to the underlying API operations. A tool named search may also update indexes, export records, or invoke another service.
- Record downstream checks that can narrow or expand access, including row-level, tenant-level, network, device, or approval policies.
- Mark wildcard actions or resources, unused grants, cross-tenant paths, administrative roles, shared credentials, and any permission that can create broader credentials.
Represent the result as a policy graph: principal → identity provider → gateway or tool → operation → resource → downstream authorization. Keep the raw exports with a timestamp so a later reviewer can distinguish a permission that existed from one that was merely inferred.
How do I map an agent workflow to least agency?
For each documented workflow, write the smallest set of actions required to complete it. OWASP describes this as “least agency”: give an agent only the autonomy, tools, and access its task requires, for only as long as it needs them.
Build a task-to-action matrix
| Workflow element | Questions to answer |
|---|---|
| Task | What business outcome is the agent expected to produce? |
| Tool and operation | Which exact API, method, command, or plugin operation is necessary? |
| Resource | Which records, repositories, tenants, environments, or message destinations are in scope? |
| Data effect | Is the operation read, create, modify, delete, publish, or credential-related? |
| Time and conditions | When may it run, for how long, and what approval or context must be present? |
| Human control | Which actions require fresh approval, dual control, or a reversible preview? |
Compare this matrix with observed tool calls and effective permissions. Remove grants that never appear in a legitimate workflow, split read and write identities, and constrain audience, resource, tenant, and time wherever the platform supports it. Do not rely on the model to follow a sentence in a system prompt; policy must be enforced where the tool request is executed.
Where should authorization be enforced?
Put a deny-by-default policy decision at the gateway or tool-execution boundary. The model can propose an action, but a backend policy must verify the principal, operation, resource, audience, context, and approval state before any side effect occurs.
Use explicit per-tool and per-operation allowlists
- Allow only named tools and operations; deny unknown or newly added operations until reviewed.
- Bind each operation to an audience, resource pattern, tenant, environment, and time condition.
- Separate read, write, delete, publish, permission-management, and credential-management capabilities.
- Require a fresh, time-bound approval for irreversible or high-impact actions. The approval should identify the exact operation and resource, not merely the agent.
- Return a structured denial to the orchestrator and log the attempted action; never silently fall back to a broader credential.
- Prevent prompt text, tool output, or retrieved documents from changing authorization policy.
High-impact actions should stop when approval is missing, expired, or tied to a different resource. If an agent delegates to another agent, the downstream call must carry a verifiable chain of delegation and a scope no broader than the original authorization.
Recommended Free Tools
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do I test token expiry, rotation, and revocation?
Use a non-production identity or a replayable test wherever possible. A successful issuance test is not enough; the important evidence is that access stops when the lifecycle event says it should.
- Baseline denial: attempt an operation outside the task-to-action matrix and confirm the gateway and downstream service both deny it.
- Scope boundaries: use the same token against an unauthorized resource, tenant, audience, and operation. Confirm that each restriction is enforced independently.
- Read/write separation: verify that a read credential cannot create, modify, delete, publish, or change permissions.
- Approval gate: submit a high-impact request without approval, with an expired approval, and with approval for a different resource. All must stop before the side effect.
- Expiry: wait until the token is expired or use a controlled test clock, then retry through every relying service and cache.
- Rotation: issue a replacement credential, update the consumer, and prove that the old credential fails at the gateway and each downstream service.
- Revocation: disable the agent, invalidate tokens, remove stale permissions, and verify propagation to caches, queues, worker processes, and delegated services.
- Recovery: restore only the intended credential and confirm that the agent resumes its documented workflow without regaining removed access.
For every test, retain the test identity, timestamp, request or correlation ID, expected result, observed result, response status, and logs from each enforcement point. Microsoft specifically recommends testing disabling the agent, rotating credentials, invalidating tokens, and removing stale permissions rather than assuming a control works because its configuration exists.
What logs prove that an agent action was authorized?
Authorization evidence must connect the proposed action to the identity, policy decision, approval, and resulting side effect. Correlate orchestrator traces, agent tool-call logs, API-gateway records, IAM events, secret-vault access, and endpoint telemetry with one request or correlation ID.
Minimum event fields
- Agent principal and, where applicable, delegated user
- Credential identifier or token fingerprint without logging the secret itself
- Issuing authority, audience, effective scopes, roles, claims, and resource restrictions
- Tool, operation, resource, tenant, environment, and source network or workload
- Policy version, decision, approval identifier, approver, and approval expiry
- Timestamp with synchronized clock information, request and correlation IDs
- Result, status code, bytes or records affected where appropriate, and downstream response
- Credential issuance, exchange, rotation, revocation, and permission-change events
Alert on first-seen destinations, unusual volume, source changes, off-hours use, scope expansion, bursts of failed authorization, privilege changes, and actions outside the task-to-action matrix. CISA guidance calls for continuous monitoring and regular security assessments; tune alerts to the agent’s normal workflow so a rare but legitimate deployment is explainable rather than invisible.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsHow should I remediate excessive access?
Remediation should reduce blast radius without breaking the approved workflow. Make one change at a time when possible, then rerun the relevant authorization and lifecycle tests.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Remove wildcard actions and resources; replace them with named operations and bounded resource sets.
- Split identities by environment and function, especially production versus non-production and read versus write.
- Shorten credential lifetimes and move secrets out of prompts, local files, process environments, and build logs into an appropriate managed store or workload-identity mechanism.
- Add approval gates for deletion, external publication, permission changes, deployment, purchasing, funds movement, and credential operations.
- Rotate or revoke exposed credentials immediately, then search logs and caches for reuse.
- Delete unused plugins, stale group memberships, abandoned service accounts, and obsolete trust relationships.
- Document every accepted exception with rationale, compensating controls, accountable owner, approving authority, and expiry date.
- Re-review after a workflow, tool, data-scope, model-orchestrator deployment, or downstream policy change.
Handle a suspected token exposure
First stop further use by disabling the agent or revoking the credential, then preserve gateway, IAM, vault, deployment, and endpoint logs before cleanup removes evidence. Determine whether the token was exchanged for another credential, whether a delegated identity was involved, and which resources were reachable during its valid period. After containment, issue a replacement with narrower scope, validate revocation propagation, and record the incident and corrective actions in the agent’s audit file.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Which identity and authorization architecture should an audit compare?
No single architecture is correct for every agent. Compare the design on the dimensions below and choose the combination that gives the smallest practical blast radius and the clearest evidence.
| Comparison axis | Options to examine | Audit question |
|---|---|---|
| Identity model | Workload identity, service account, delegated user, agent-specific principal | Can every action be attributed to one agent and, when delegated, to the originating user? |
| Authorization model | RBAC, ABAC, ReBAC, capability tokens, policy decision point | Can policy express operation, resource, tenant, time, and approval constraints? |
| Token proof | Opaque token, JWT, signed request, mTLS, hardware-backed key | How do relying services verify issuer, audience, integrity, and possession? |
| Storage | Managed vault, HSM-backed key, workload identity, local cache | Can a process, prompt, log, or developer extract the credential? |
| Lifetime and rotation | Short-lived issuance, scheduled rotation, event-triggered rotation | What event invalidates the old credential, and how fast does that reach every service? |
| Scope granularity | Action, resource, audience, tenant, and time restrictions | Can a token be useful for one task without granting unrelated access? |
| Human control | Fresh approval, time-bound elevation, dual control, automatic rollback | Are irreversible actions blocked until the correct person approves the exact request? |
| Observability and revocation | Correlated traces, policy logs, IAM events, vault and endpoint telemetry | Can investigators prove authorization and confirm revocation propagation? |
| Compromise impact | Single-task, single-tenant, environment-wide, or cross-system reach | What is the maximum damage if the process or token is stolen? |
How often should an autonomous agent be re-audited?
Set the cadence from impact, data sensitivity, autonomy, and change rate rather than choosing a universal interval. Perform a full review when an agent is introduced or gains a new tool, data class, environment, or delegation path. Trigger a focused review after a model, orchestrator, plugin, policy, identity-provider, or downstream-system change, and after any incident or unexplained authorization alert.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteBetween formal reviews, continuously watch token use, privilege changes, new destinations, failed authorization, and deviations from the task-to-action matrix. Keep a dated record of the last effective-permission export, lifecycle test, exception approval, and remediation so an auditor can see what was true at a particular point in time.
What should be in the final audit package?
Assemble a package another engineer can reproduce without privileged guesswork:
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- Scope, risk classification, owner, purpose, environments, tools, data classes, and downstream systems
- Identity and token inventory with storage locations and credential-administration principals
- Effective-permission graph and task-to-action matrix
- Gateway and tool policies, approval rules, and policy-version identifiers
- Expiry, rotation, revocation, denial, and approval test results
- Correlated runtime evidence and alert review
- Remediation tickets, verification results, and accepted exceptions with expiry dates
- Next review triggers and the person responsible for revalidation
The package should show both configuration and behavior. A policy export proves what was intended; replayable tests and correlated logs prove what the agent and relying services actually enforced.
What is the practical standard for a trustworthy agent?
A trustworthy autonomous agent has one accountable identity, narrowly defined and time-limited authority, backend-enforced tool controls, tested lifecycle events, and evidence for every consequential decision. If you cannot identify the owner, reconstruct effective permissions, or demonstrate that a revoked token fails everywhere, the audit is incomplete and the agent’s authority is larger than you can safely explain.
Frequently Asked Questions
Can an autonomous agent use a human employee’s access token?
Avoid sharing a human token directly with the agent. Use a delegated flow that records the human subject and the agent principal separately, limits the delegated scopes and audience, and allows the human delegation to be withdrawn without disabling the employee’s normal account.
How can I audit a system where several agents call one another?
Give each agent its own principal and require a verifiable delegation chain on every hop. Check that the downstream agent cannot exceed the upstream scope, and correlate the full chain in logs so investigators can identify the first requesting agent and the approving user.
What should I do if a token appears in a prompt or log file?
Treat it as exposed: revoke or rotate it, preserve relevant evidence, search for reuse, and inspect caches, transcripts, build artifacts, and observability exports. Replace the workflow with a vault or workload-identity exchange so the model and ordinary logs never receive the secret value.
Is there one mandatory standard for autonomous-agent permissions?
No universal agent-token standard or review interval is established by the cited guidance. Combine the identity and lifecycle controls in NIST IR 8587, OWASP’s least-agency and deny-by-default practices, Microsoft’s testing recommendations, and CISA’s autonomy and monitoring guidance, then tailor depth to your system’s impact and change rate.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →How do I prove that a permission removal reached every service?
Record the removal event and test the old credential through each gateway, cache, queue worker, plugin, and downstream API that previously accepted it. Keep request IDs and timestamps for every denial, because a single successful retry from a stale cache means revocation has not fully propagated.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
