How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · Agent and Orchestrator Identity
Give each agent its own identity
Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.
OWASP AISVS v1.01, requirement 9.4.1
In plain English
Give each agent instance its own cryptographic identity, so downstream systems know which agent is calling and can apply rules to it.
What good looks like
- Each agent instance gets a unique identity.
- It authenticates to downstream systems as itself.
- Logs record which instance did what.
How teams usually do it
- Workload identity from your platform, or short-lived certificates per instance.
Evidence an auditor would accept
- Identity configuration and sample logs.
Common mistakes
- All agents sharing one service account.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.