The first three parts made an argument: an agent's blast radius is its identity, you enforce it at the gateway, and you retire standing keys with short-lived, brokered credentials. This final part turns that into something you can act on before your next sprint.
Measure the problem in your own account
The industry numbers are abstract until you find them in your environment. The Entro H1 2025 report (vendor-reported) gives you the exact things worth counting:
| What to find | Why it matters | Industry signal (Entro H1 2025) |
|---|---|---|
| Machine identities with admin | One wrong agent = full blast radius | 5.5% hold admin, often by default |
| Overprivileged non-human identities | Excess scope is latent blast radius | ~9% of AWS NHIs |
| Old secrets still active | Age ≈ exposure window | 7.5% are 5–10 years old; >2% are over a decade old |
| Secrets outside code repos | The places scanners miss | 43% found in CI/CD logs, Slack, Teams, etc. |
If you only do one thing, find the admin machine identities. That 5.5% is where a single mistake becomes an incident.
The checklist
Sequencing it
You do not have to do all of this at once. A sane order:
- Stop the bleeding — kill or scope the admin NHIs an agent could assume.
- Shorten lifetimes — switch agent credentials to STS short-lived tokens so a leak expires on its own.
- Centralize the chokepoint — route MCP through a gateway so the next agent inherits the controls instead of re-inventing them.
- Make authorization per-action — so access reflects the real caller at the moment of use, not a grant frozen at provisioning.
Each step shrinks the blast radius even if you never reach the next one.
Honest limits
Two caveats, in the spirit of the series:
- The Entro and GitGuardian figures are vendor-reported. They are directionally consistent and useful for prioritization, but cite them as such.
- The fast-moving MCP threat headlines — CVE counts, tool-poisoning success rates — are deliberately absent here because I could not verify them against primary sources. The case for governing agent identity stands without them; if you want to use the threat framing, source it independently first.
The takeaway
The non-human identity crisis is not a future problem or a model problem. It is a present, measurable property of your AWS account: how many machine identities hold admin, how old your secrets are, and how many live outside your repos. Count those three things this week. Then govern agents the way you would govern any powerful identity — at the gateway, with short-lived, brokered credentials, and an authorization decision made fresh for every action.
That is the whole series in one sentence: secure the identity, not just the prompt.
Researched and drafted with AI assistance; the audit signals are cited to Entro and GitGuardian (vendor reports), the AWS controls to AWS documentation, and a human reviewed before publishing.
I help teams across Asia-Pacific turn ambitious AI ideas into shipped, well-crafted products — pairing deep cloud architecture with a product designer's eye for clarity and trust. I write and speak about applied AI, developer experience, and the craft of building things that last.