Shared Agent Identity

Shared agent identity occurs when multiple synthetic subjects, workflows, tools, or deployments authenticate through the same service account, token, credential, or application identity.

This configuration creates an elevated exposure condition because activity cannot be cleanly attributed to a specific synthetic subject. Logs may show that a shared identity accessed data, called an Application Programming Interface (API), sent a message, or updated a record, without showing which agent or workflow caused the action.

The primary risk is attribution failure. If several synthetic subjects use the same identity, investigators may be unable to determine which one acted, whether the action was authorized, or which directive, invocation, tool, or input caused the event.

Investigators should review service account usage, token assignments, connector credentials, authentication logs, agent configuration files, workflow ownership, and identity governance records. Particular attention should be given to credentials reused across agents, vendors, environments, or business functions.

Investigative Relevance

Shared agent identity is relevant because identity separation is required to reconstruct synthetic subject behavior. Where multiple agents act through one credential, containment may require disabling several workflows at once, and accountability may remain unclear.