01 / The operating case
What changes in a real workflow?
An automation remains active after its creator leaves; no current team can approve its access or respond to an alert.
- 01Owner
- 02Agent + workload
- 03Task context
- 04Action decision
02 / Decision boundary
Put the check where it can stop the effect.
Require an accountable owner at registration, review ownership on role changes and suspend high-impact grants when ownership becomes unknown.
Architecture review / negative test
Make the boundary testable.
Ownership should survive personnel changes. Define an accountable team, approval authority, purpose, supported runtime, credential steward and retirement rule. A registry entry without an active review process only makes an orphan easier to count; it does not disable the agent’s standing credentials.
03 / Failure and evidence
What goes wrong, and what can be proven?
A technically valid credential conceals an orphaned agent with no approved business purpose.
Preserve owner transitions, recertification, suspension and linked task approvals.
04 / Canonical scope
Why this reference stands alone
The identity lifecycle page will cover credential rotation; this page owns organizational accountability.
Primary references