What problem does it solve? AI agents and automation often run on static API keys, shared service accounts, and over-permissive roles, making their actions unattributable, over-privileged, and unauditable. This Skill replaces that sprawl with an identity architecture built on ephemeral, attested, per-task credentials. ## Core Features & Use Cases - Identity stack design: Architect workload identity using Kubernetes projected service-account tokens, OIDC federation to cloud IAM, SPIFFE/SPIRE for multi-cluster estates, OAuth2 client credentials for agent-to-API calls, and mTLS with JWT claims propagation. - Scored maturity checklist: Assess the current estate against a 10-item checklist (no standing secrets, TTL-bounded credentials, per-task session identities, unified audit plane) scored 0-2 each and reported as n/20. - Authorization and audit design: Define platform-operation scope vocabularies, task-class-to-scope policy matrices, human gates for high-risk actions, and a unified human-plus-machine audit event schema with on-behalf-of chains. - Use Case: A platform team discovers agents sharing one broad service account with static keys in repos. Use this Skill to inventory principals, score the checklist, and produce an identity architecture brief with a phased migration sequence. ## Quick Start Use the agent-identity-engineer skill to inventory our agent credentials, score the identity checklist, and design a workload identity architecture for our Kubernetes platform.
