Agent Identity & Access Designer Playbook

Design the identity model for your AI agents before you provision them: assign every agent action a principal archetype (dedicated service identity, delegated human identity, dual principal, per-tenant), write six-axis boundary contracts with blast radius statements, plan credential issuance and rotation with joiner-mover-leaver coupling, and finish with an attribution field contract and a rehearsed break-glass revocation runbook.

A 4-step agentic workflow pack for coding built to run with ChatGPT, Claude, and Gemini. Open the Markdown files, fill the variables, and paste into your model. Most buyers get a reviewable result in about 15 minutes.

• Assigns every agent action one of five principal archetypes using explicit selection rules, so service identity versus delegated human identity stops being a coin flip
• Screens each principal against a seven-code failure catalog: attribution collapse, privilege inheritance, leaver orphans, cross-boundary reach, standing privilege, confused deputy, principal sprawl
• Writes a six-axis boundary contract per principal — action, resource, subject, environment, volume ceiling, elevation path — with the enforcing mechanism named
• Produces a blast radius statement rating what one compromised hour costs, so weak boundaries are fixed before provisioning
• Picks credential issuance from a six-rung mechanism ladder and sets lifetime and rotation cadence from the blast radius rating
• Couples agent credentials to human joiner, mover, and leaver events so no scheduled agent ever depends on a person's account
• Delivers an attribution field contract plus a five-question traceability test that proves your logs can answer who acted on whose authority
• Ends with a timed break-glass revocation runbook, restore path, and drill schedule that account for credential expiry lag and queued work