An AI-enabled workflow often begins with the quickest available route into an existing system. Someone creates a token from their own account, connects the prototype, and demonstrates that the interaction works.

The shortcut is understandable. Leaving it in place is not.

When an automated service authenticates as a named person, the receiving system records a fiction. Its audit log says that a human viewed the record, changed the status, or sent the message. The person did none of those things. The system did.

That creates several problems at once.

Attribution is no longer reliable

An audit trail should answer who or what performed an action. Personal authentication collapses those identities together. During an incident, it becomes difficult to distinguish deliberate human activity from automated behaviour, compromised credentials, or a faulty integration.

The problem is especially serious when the account has broad access. The automation inherits permissions accumulated for a person’s wider role, even if its own task requires only a narrow subset.

Access reviews become misleading

A manager may confirm that a colleague still needs access without knowing that the same identity is also operating a production integration. Disabling the account when the person changes role can unexpectedly stop the service. Keeping it active after the person leaves creates a different risk.

Credential rotation has the same problem. A security control applied to the person becomes an unplanned production event for the automation.

The correct pattern is explicit service identity

The automation should authenticate as itself. Its identity should have:

  • A documented owner
  • The minimum permissions needed for its defined tasks
  • Credentials stored and rotated through an appropriate secret-management process
  • Logs that identify both the service and, where relevant, the initiating user or case
  • A clear process for review, suspension, and retirement

Some platforms call this a service account, application identity, workload identity, or managed identity. The name matters less than the separation.

Identity is part of the product design

This is not merely an infrastructure detail to correct before launch. The identity model determines what the system may do, how its actions are attributed, and whether an operator can investigate its behaviour.

If an agent can take consequential action, its identity and permission boundaries belong in the acceptance criteria from the start.