An agent should never borrow your keys

The first agent almost everyone ships authenticates as its author. Someone mints a personal access token, drops it into an environment variable, and the agent inherits every permission that person holds. It works on day one. It is also the single decision that makes everything downstream harder to reason about.

Once an agent is wearing a human's credentials, three things become impossible at once. You cannot tell from the logs whether a person or a process took an action. You cannot revoke the agent without locking out the person. And you cannot give the agent less authority than its author has, which means in practice every agent runs at the maximum privilege of whoever set it up.

An agent that logs in as you is not an agent. It is you, with worse judgment and no memory of why.

Impersonation is a design decision, not a detail

It is tempting to treat this as plumbing to fix later. It is not. Identity is the substrate that every other guarantee rests on. Audit trails are only meaningful if actions have unambiguous authors. Permissions are only meaningful if the thing being permitted is a distinct subject. Rate limits, budgets, suspension, and reversal all need something to attach to. When agents borrow human identities, all of those controls attach to the wrong object.

The failure mode is not dramatic. Nothing breaks. You simply arrive, six months in, at a system where nobody can answer a question that should be trivial: which of these thousand actions were taken by a person, and which were taken by software acting on their behalf?

What a first-class identity actually requires

Treating an agent as its own actor is more than a label on a row. At minimum it needs:

• Its own credential, issued to it and revocable on its own, without disturbing any human account
• Its own permission set, which can be narrower than any person's, and usually should be
• Its own entry in the audit record, so every action has one unambiguous author
• A human owner, so there is always someone accountable for what it does
• A lifecycle: created, granted, exercised, suspended, retired

The last two matter more than people expect. Anonymous automation is a governance problem, and organizations are bad at governance problems. Automation with a named owner and a defined lifecycle is a staffing problem, and organizations have handled staffing problems for a century. The framing changes what the rest of the company is able to do with it.

The scoping question nobody asks early enough

Real deployments are multi-tenant almost immediately, even inside a single company. An agent built for one team gets borrowed by another. A key minted for one project ends up in a script that touches three. If the credential does not carry its own boundary, that boundary does not exist.

The useful shape is a credential that knows what it may reach: bound to a single organization, or to a named set, or deliberately unbounded for an operator who needs it. The point is that the scope is a property of the key, checked on every call, rather than a convention in a runbook that someone will eventually break.

Where this is heading

The assurance frameworks now being written for AI systems keep converging on the same two demands: attribution and reversibility. Show who did what, and show that it can be undone. Both are downstream of identity. A stack that cannot say which actor took an action cannot satisfy either, no matter how good its model is or how careful its prompts are.

How we think about it

On Recursiv an agent is a first-class account, not a configuration file. It has its own record, its own owner, its own credential, and its own scope. It can be suspended without touching a person. Every action it takes is attributable to it specifically, and the record of that action is not something the agent itself can rewrite.

None of this is exotic. It is the same set of assumptions any serious system makes about human users, applied to the non-human ones. The mistake the industry made was assuming agents were a feature of an application rather than a class of actor inside it.