01 / The operating case
What changes in a real workflow?
A short-lived document agent processes invoice I-42 and exits, rather than reusing the same service account across all invoices.
- 01Owner
- 02Agent + workload
- 03Task context
- 04Action decision
02 / Decision contract
What the executor must check
Issue a task-bound identity, bind it to its hosting workload, limit token lifetime, revoke it on completion and preserve evidence afterward.
Architecture review / negative test
Make the boundary testable.
A per-task agent identity can improve audit granularity, but every newly created identity needs a stable owner and trusted workload binding. Retire its credential promptly while retaining the immutable task reference. Avoid creating identities so short-lived that investigators cannot reconstruct which actor made a call.
03 / Failure and evidence
What goes wrong, and what can be proven?
Identity disappears before audit records are retained, or the reusable backing credential remains overprivileged.
Keep immutable task and owner references after the ephemeral credential is destroyed.
04 / Canonical scope
Why this reference stands alone
Task-bound authority controls what the agent may do; this page controls how a short-lived actor is identified.
Primary references