AI agents & non-human identity

Every agent gets an identity, an owner and limits.

Give every AI agent its own identity with an owner and a lifecycle. Agents act on behalf of users with authority that only ever narrows.

Book a technical demo HelixIAM AI Identity

What you get

An identity per agent

Not a shared service account: each agent is registered with an accountable owner, its own roles and an expiry date.

Lifecycle: active, suspended, expired, revoked
Agents whose owner has left are flagged for review
Every agent token issued or refused, direct or delegated, in the searchable audit log

On-behalf-of delegation

Standard OAuth token exchange (RFC 8693): the token carries the user as subject and the agent as actor.

Authority is the intersection of user and agent
Restricted to the requested scope and audience
Readable by any OAuth-aware resource server

Suspend and contain

Suspend an agent and it gets no new tokens; resource servers that introspect see the revocation at once.

Short-lived, audience-restricted tokens
Suspend, reactivate or revoke from the console or API
Ready for MCP: protected-resource metadata (RFC 9728)

What a delegated token looks like.

The agent exchanges the user's token for one that names both, with narrowed scope.

token exchange · RFC 8693200 OK

Request · agent acting for alice

POST /realms/acme/oauth2/token
grant_type=urn:ietf:params:oauth:grant-type:token-exchange
subject_token=eyJ…  # alice
actor_token=eyJ…  # agent: invoice-assistant
scope=invoices:read

Issued access token · decoded

{
  "sub": "alice",
  "act": { "sub": "agent:invoice-assistant" },
  "scope": "invoices:read",
  "aud": "https://api.acme.example/invoices",
  "iss": "https://id.acme.example/realms/acme"
}

actThe agent is named in every token; the user stays the subject.
scopeAuthority narrows to what the agent needs. It never widens.
ownerSuspend the agent and it gets no new tokens.

Illustrative values · RFC 8693 token exchange

See an agent act for a user — and stop it.

Book a technical demo of HelixIAM AI Identity.

Book a technical demo HelixIAM AI Identity