top of page
A06
Agent Identity & Authorisation
Where an agent's credentials cannot be issued at runtime, they are rotated on a defined cycle and immediately on change of agent owner, decommissioning, or suspected compromise.
WHAT IT ADDRESSES
Long-lived static keys outliving the agent, its owner, and the reason it existed.
VERIFICATION METHOD
Rotation records and last-rotation dates for all static agent credentials.
OWASP T&M
bottom of page