One layer is never enough
Access control for agents is a stack, not a setting. Each layer answers one question, and the layers back each other up: when one fails, the next should catch the attempt and the last should prove it happened.
The five layers
| Layer | Question it answers | Mechanism |
|---|---|---|
| Identity | Who is this? | Named accounts, no shared logins — team roles |
| Device | Which machine? | Device registration and revocation |
| Policy | What may it do? | Central policy, tool allowlists, secure mode |
| Secret | What may it spend? | Key vault, per-member grants |
| Evidence | What actually happened? | Audit trail, signed and append-only |
How the layers compose
A device with a stolen token still hits the policy layer when it tries something odd, and the evidence layer records the attempt regardless. A policy mistake still shows up as a spend anomaly under the secret layer’s alerts. Defense in depth is just this: no single layer must be perfect.
Review the stack, not just the settings
Quarterly: list members, devices, policy exceptions and key grants; remove what should not be there. That review is itself a control — the one auditors check first, per audit compliance.