What's this about?
Enterprises are deploying autonomous agents on top of an access-control model designed for two things: human users and long-lived services. The paper argues the fit fails in three specific ways, the first being that agent principals are ephemeral — they appear and vanish far faster than any identity system expects — and proposes five runtime primitives to govern them instead.
What is a "principal"?
In access control, a principal is whoever the system thinks is acting: a user account, a service account, an API key. Everything else — permissions, audit logs, revocation — hangs off that identity. The assumption baked into every enterprise identity system is that principals are relatively stable: you create a user, they exist for years, you delete them. An agent spawned for one task and gone in ninety seconds breaks that assumption at the root, which is why bolting agents onto existing IAM tends to produce either over-broad service accounts or unusable friction.
Why does this matter to you?
- It is the governance-side counterpart to the Hugging Face incident: that failure was agents reaching each other through shared infrastructure, which is a principal and permissions problem before it is a model problem.
- "Ephemeral principal" is a useful term for anyone auditing what an agent was allowed to touch after the fact.
- Pairs directly with the multi-agent risks framework below, which handles the cross-organisation case.