Platform teams are no longer preparing for the occasional bot or CI runner — they're engineering for millions of non-human identities and autonomous workflows. The most consequential piece in recent platform writing is blunt: treat agents and machine identities as first-class operational objects, or pay for it with incidents, compliance gaps, and endless credential churn.
That argument appeared in recent Platform Engineering posts (for example, "Platform Engineering 2.0" and "IDPs for AI agents") and is reinforced by Google Cloud research that pushes IDPs toward measurable engineering disciplines rather than a grab-bag of tools. The practical pattern is consistent across sources: identity, guardrails, autonomous workflows, then measure value with DORA and the Four Keys project.
Why this is different
We already had workload identity, OIDC, SPIFFE-style names, and short-lived tokens. Those remain necessary but insufficient. Autonomous agents change the risk model in three ways: they massively increase identity cardinality, they demand different interaction patterns (ephemeral sessions, programmatic escalation, delegated workflows), and they operate at higher speed — meaning mistakes propagate faster.
Treating non-human identities as first-class means three shifts you can't postpone:
- Model lifecycle and policy at scale. Create APIs and CRDs around machine identities: issuance, rotation, lease, revocation, and ownership. Treat an agent identity like a service: attach metadata, SLOs, and on-call playbooks.
- Build constrained golden paths for agents. Expose only the safe primitives an agent needs (parameterized runbooks, narrow RPCs, canned remediation actions) and make the platform the single audit log and enforcement plane.
- Measure impact with DORA/Four Keys. Track how platform changes change flow, not just tickets saved. Google Cloud's guidance on Four Keys frames IDP impact in terms of deployment frequency, lead time for changes, change failure rate, and MTTR.
Concrete controls that matter
You can be specific: short-lived OIDC tokens and workload identity federation for identities; automated rotation and scoped credentials; policy-as-code (Rego/OPA) combined with runtime enforcement (Envoy/Istio) and static checks for golden-path APIs; and comprehensive audit trails surfaced in the portal so every agent action is attributable and replayable. SPIFFE/SPIRE or similar mTLS tooling should be on your short list — but the real work is in the orchestration and lifecycle APIs, not the crypto primitives.
Two operational pitfalls teams are already tripping over
First, treating agents like human users. Agents need narrower scopes and much more aggressive TTLs. Second, trying to bolt observability on after the fact. If your IDP can't map agent actions to DORA outcomes (for example, how many agent-driven remediations reduced MTTR), it's just another log stream.
An opinion: this is overdue and overdue in a predictable way. Platform teams who treated identity as "infrastructure plumbing" for humans have spent the last five years cleaning up token sprawl. Making machine identities explicit and operational is the right call — it's cheaper and safer to build lifecycle primitives into the IDP now than to retrofit policies and incidents later.
If you want a practical next step, start by instrumenting the IDP portal for delivery outcomes, not just adoption. Google Cloud's guidance on using Four Keys and DORA for IDP measurement is the right lever to pull — it's hard to secure what you can't measure. Read their framing here: Google Cloud research: Use Four Keys and DORA to measure IDP impact and compare it to the agent-first design patterns discussed in earlier platform writing, e.g. Platform Engineering Embraces the Agent-First Paradigm.
Final thought: teams that build identity-first IDPs and line up golden paths to measurable delivery outcomes will turn agent scale from an operational headache into a competitive lever. Everyone else will get surprise credentials, surprise incidents, and surprise audits. The clock is ticking — and this time the identity problem is both the cause and the cure.