Give an identity agent only the data and actions its assigned task requires. There is no universal permission bundle: the right access depends on what the agent does, whether it acts for a signed-in person or independently, which resources it uses, and the impact of its actions. Use a distinct, accountable identity, scope grants to specific resources, enforce authorization at the services holding the data, and make access reviewable and revocable.
What access does an identity agent need?
Start with the task, not a standard bundle of roles. List the information the agent must read or change, the APIs and tools it must call, and the specific resources it must reach. Then grant only the operations needed for that task. An agent that summarizes one user’s calendar, for example, has a different access need from an autonomous agent that manages cloud resources.
As an Amazon Associate I earn from qualifying purchases.
The exact grants cannot be determined without knowing the agent’s task, operating mode, data classifications, target services, and allowed actions. Platform examples such as a storage-viewer role illustrate how a grant can be scoped; they are not a default permission list.
Should it act for a user or as its own identity?
Choose the authorization model that matches how the agent operates. Delegated authorization carries a signed-in user’s authority; application or workload authorization gives the agent authority of its own. Do not use broad application permissions merely because they are convenient when delegated access can do the job.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Operating model | Typical authorization | Use it when | Important boundary |
|---|---|---|---|
| Interactive, user-directed agent | Delegated user permissions; Microsoft documents the on-behalf-of (OBO) flow for this scenario. | The agent performs tasks for a signed-in user, such as accessing that user’s mail, calendar, or files. | Access should be limited to what the user and application have authorized. In Microsoft tokens, delegated permissions appear in the scp claim; some permissions require administrator consent. |
| Autonomous agent | Application permissions or a workload identity; Microsoft describes client credentials with required app permissions, while Google Cloud documents access using an agent’s primary SPIFFE identity. | The agent runs without a user and must act under its own authority. | Grant only the roles and resource access needed for its task. Microsoft represents application permissions in the token’s roles claim. |
| Agent accessing a cloud service for an end user | A separate end-user authorization flow; Google Cloud directs developers to 3-legged OAuth for this case. | The agent needs to reach a service on behalf of a person rather than solely under its own cloud identity. | Keep the end user’s delegated authority distinct from the agent’s own workload authority. |
In Microsoft’s documented OAuth model, delegated scopes such as User.Read or Mail.Read are reviewed through the OAuth flow, while administrator-restricted permissions need an administrator. The names are examples of scopes, not recommendations for every agent.
How narrowly should permissions be scoped?
Attach permissions as close as possible to the resource and operation the agent needs. Prefer a specific site, API, mailbox, team, vault, or cloud resource over a tenant-wide grant. A Microsoft example is assigning Key Vault Reader on one vault; its guidance also describes Exchange RBAC for one or a few mailboxes and Teams Resource-Specific Consent at the team level. Azure RBAC assignments can be made at resource, resource-group, or subscription scope, so select the narrowest workable level.
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
For Google Cloud, grant the agent’s required role on the target resource. The appropriate role depends on both that resource and the operation; a documented role such as Storage Object Viewer should not be copied as a general agent role.
Recommended Free Tools
- Separate read access from create, update, delete, and administrative actions.
- Limit access to the particular data source or resource involved in the task.
- Use action allowlists where the agent’s tool interface supports them.
- Review effective permissions across connected agents and integrations, not just each grant in isolation.
What extra controls do sensitive data and high-impact actions need?
Personal, health, and financial information calls for explicit access approvals, tighter scopes, and strong auditing. Check that the downstream service holding the data enforces authorization itself; a restriction in the agent orchestrator alone is not enough.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
For destructive or privileged operations—such as deleting data or changing access rights—use stronger controls than for routine reads. Options include requiring a person’s approval, allowing only specified actions, or granting elevated access for a limited period. Match the control to the consequences and reversibility of the action.
Google Cloud distinguishes human-in-the-middle operation, where a person approves each action, from agent-only operation. Human approval can reduce risk, but it is not a guarantee: a person may approve an unsafe suggestion. Agent-only operation depends on the agent’s programming and is exposed to risks including prompt injection, insecure tool chaining, and naive error handling.
Rank #4
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
How should an agent’s identity and access be managed?
Give each agent instance a distinct identity rather than sharing one identity among unrelated agents. Distinct identities make actions easier to trace and allow one agent to be disabled without disrupting others. Assign a sponsor accountable for the agent’s purpose and a technical owner responsible for its implementation; document its scope.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches- Protect credentials: Microsoft recommends managed identities or certificates for production and separate credentials across environments.
- Monitor use: Track token use, permissions, access events, and permission changes to spot unexpected activity or privilege creep.
- Review access: Reassess grants periodically and remove rights the agent no longer needs.
- Plan revocation: Be able to disable the identity and verify that access is also blocked at downstream services.
What should agent-access logs capture?
Logs should make it possible to connect an action to the agent identity and understand what data and tools were involved. NIST NCCoE’s February 2026 concept paper identifies linking actions to non-human identities, maintaining visibility into actions and outcomes, and tracking prompt and input-data provenance as areas under consideration. It is a concept paper describing project direction, not a binding universal standard or a fixed logging specification.
Best Value
![FIDO2 Security Key [Folding Design] Thetis Universal Two Factor Authentication USB (Type A) for Multi-Layered Protection (HOTP) in Windows/Linux/Mac OS,Gmail,Facebook,Dropbox,SalesForce,GitHub](https://m.media-amazon.com/images/I/319b82vXgEL._SL160_.jpg)
- Passwordless World - A revolutionary new way to protect your account info. By being FIDO2 certified by the world’s largest ecosystem for standard-based, interoperable authentication, FIDO2 makes everyday log-in experience effortless and passwordless yet more secure than generic password style security. **Note: FIDO2 does NOT support Mac log-in.
- Online Account Protection - FIDO2 key is backward compatible with U2F protocol and works with the newest Chrome browser with operating systems such as: Windows, macOS, or Linux. U2F can be supported and protected on all websites that follow U2F protocols.
- Multi-factored Authentication - Built-in, advanced HOTP (One Time Password) technology that completes the unique multi-factored authentication process. Eliminate worry and help prevent losing your account info to theft, phishing, hacking, or other online scams. Note: Only Enterprise Users using Azure Active Directory can access Windows Hello log-in via Thetis FIDO2 Security Key.
- Compact And Durable - 360° design with rotating aluminum alloy cover that shields the USB connector when not in use. Tough and durable alloy protects FIDO2 key from daily wear-and-tear, accidental drops, and scratches.
- Portable Design - ultra-portable design allows you to take your FIDO key anywhere you need it.
The same paper discusses OAuth 2.0 and extensions, OIDC, MCP, SPIFFE/SPIRE, and SCIM among relevant standards and practices. Which mechanisms apply depends on the identity provider and services in use.
Quick Recap
A practical way to decide what to grant
- Define the task: Specify what the agent may read, change, or initiate, and identify the data and target services involved.
- Choose the authority: Use delegated access when it acts for a signed-in user; use an agent-owned or workload identity when it must operate autonomously.
- Set the narrowest scope: Grant the required operation on the smallest practical resource boundary, rather than granting broad tenant or service access by default.
- Apply risk controls: Add explicit approval and stronger or time-limited access for regulated data, destructive actions, and privilege changes.
- Verify enforcement and accountability: Confirm the target service checks authorization, actions are attributable to the agent, an owner is assigned, and access can be reviewed and revoked.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
