Platform teams with SPIFFE or SPIRE in place who are now running agents.
How to use a workload identity for an agent, and what to add so the delegated human remains visible.
The control gap
SPIFFE solves the bootstrap problem properly. A workload gets a cryptographically verifiable identity from attestation rather than from a secret someone copied into an environment variable, and that identity rotates without anyone noticing. An agent is a workload, so this all applies. The gap appears at the next hop: a SPIFFE identity says which workload is calling, and an agent action almost always also needs to say which person it is for.
What good looks like
The agent authenticates as a workload with no long-lived secret, and the delegated human travels with the request as separate context that policy and evidence both keep.
- Attest the agent workload and let it obtain its identity document at startup, with no secret in the image or the environment.
- Use the workload identity for transport-level authentication between services.
- Carry the delegated user as its own principal in the authorization request, not folded into the workload identity.
- Record both principals on every decision, so an action can be attributed to the workload and to the person.
A production workflow
- Register the agent workload and its attestation rules.
- The workload obtains its identity document and rotates it automatically.
- Each tool call carries the workload identity plus the delegated user context.
- Policy evaluates both, and the decision record retains the pair.
Evidence to require
- The workload identity presented for each call, and the attestation that issued it.
- The delegated user recorded alongside it, distinct from the workload.
- Rotation events, and any call made with an identity document past its rotation window.
- Decisions where the workload was permitted but the delegated user was not, or the reverse.
Buyer checklist
- Do your agents hold long-lived secrets today, and what would attestation replace?
- Can the decision record distinguish the workload from the person it acted for?
- Does the workload identity cross a trust domain boundary, and how is that federated?
- What happens to an agent's identity when the workload is rescheduled or scaled out?
Practical answers
Common implementation questions
Does SPIFFE replace agent authorization?
No. It answers which workload is calling, which is a prerequisite. Whether that workload may perform this action on this resource for this person is a separate decision made later in the request.
Is SPIFFE overkill for a small deployment?
Often, yes. Its value grows with the number of workloads and trust boundaries. A handful of services with managed cloud identities may already have the same guarantee with less machinery.
How does Endram use a workload identity?
As one input. The workload identity establishes the agent principal, and the delegated user, action, resource, and arguments complete the request the decision is made on.