Agent Identity: Security Beyond API Keys

Most developers today give their AI agents raw API keys for services like OpenAI, Stripe, or Twilio. This is a massive security risk. When an agent has your primary API keys, it has full access to your account with no scoping, no auditing, and no way to revoke access for just one specific agent.

The Problem of Shared Credentials#

A shared API key is a single point of failure. If that key is leaked or if the agent malfunctions, the damage is unlimited. There is no way to know which agent performed which action, and revoking the key breaks every other service or agent that uses it.

Unified Identity with Per-Agent Scoping#

Anima introduces a new paradigm: the Agent Identity. Instead of giving agents credentials, you give them identities. Each identity is scoped to exactly the permissions it needs.

An agent might have the identity to:

1. Send emails only to @example.com.
2. Make one-time virtual card payments up to $100.
3. Access a specific vault secret for a limited duration.

Comprehensive Audit Trails#

With a unified identity, every action is logged against that specific identity. This provides a complete audit trail of what the agent did, when it did it, and what credentials it used.

import { Anima } from '@anima/sdk';
 
const client = new Anima({ apiKey: process.env.ANIMA_KEY });
 
// Scoping an agent's permissions
const agent = await client.agents.create({
  name: "Sales Outreach Agent",
  scopes: {
    email: { 
      allowedDomains: ["gmail.com", "outlook.com"],
      dailyLimit: 50
    },
    vault: {
      readOnly: ["crm_api_key"]
    }
  }
});
 
// Any attempt to exceed these scopes will be blocked and logged

Instant Revocation#

If an agent starts behaving unexpectedly, you can revoke its entire identity with a single API call. This immediately cuts off its access to email, phone, cards, and secrets without affecting any other part of your infrastructure.

// Emergency revocation
await client.agents.revoke(agent.id, {
  reason: "Malicious behavior detected",
  severity: "high"
});

Moving Beyond the API Key#

Anima's approach to identity-based security allows for fine-grained control that simply isn't possible with standard API keys. By providing per-agent scoping, robust auditing, and instant revocation, we enable developers to build and deploy autonomous agents with the confidence that they are operating within safe, observable boundaries.

As we scale towards a world of millions of autonomous agents, the security of their identities will be the most critical infrastructure we build.