Per-Agent Identity in Three Layers

One agent's identity split across workload, cloud IAM, and key layers — versus one shared secret whose blast radius spans every agent

Per-Agent Identity in Three Layers One agent's identity split across workload, cloud IAM, and key layers — versus one shared secret whose blast radius spans every agent Per-agent identity (3 stacked layers) Shared secret blast radius Agent A · single workload · Architecture component Agent A single workload Workload Identity · app-level (SPIFFE) · Per-agent identity (3 stacked layers) · layer 1 Workload Identity app-level (SPIFFE) layer 1 Cloud IAM · managed identity · Per-agent identity (3 stacked layers) · layer 2 Cloud IAM managed identity layer 2 Key / Credential · cryptographic material · Per-agent identity (3 stacked layers) · layer 3 Key / Credential cryptographic material layer 3 Shared Identity · one secret for all · Shared secret blast radius · anti-pattern Shared Identity one secret for all anti-pattern Agent 1 · Shared secret blast radius Agent 1 Agent 2 · Shared secret blast radius Agent 2 Agent 3 · Shared secret blast radius Agent 3 Legend Backend Security Cloud External

Per-Agent Layers

  • • Workload identity proves the app itself
  • • Cloud IAM grants scoped resource access
  • • Keys sign and encrypt per agent

Shared Identity Risk

  • • One leaked secret compromises every agent
  • • No way to revoke a single agent
  • • Blast radius spans the whole fleet

Architecture diagram • Built with Archify • Create yours ↗ • Hover to trace • R route • Click to focus • +/− zoom • M radar • T theme • E export