Why Your AI Agent Needs Its Own Login: An Agent ID Card and Registry for Small Teams

Between August 8 and August 18, 2025, threat actors tracked as UNC6395 (GRUB1) stole OAuth access and refresh tokens belonging to the Salesloft Drift chat integration and quietly queried hundreds of corporate Salesforce and Google Workspace tenants (Google Threat Intelligence Group, August 28, 2025). At Cloudflare, attackers used that pre-approved integration token between August 12 and August 17, 2025 to export support-case records, forcing engineers to rotate hundreds of internal credentials stored inside customer tickets (Cloudflare Blog, September 2, 2025). Because requests arrived over a trusted machine connection, human multifactor prompts never fired. Nineteen months earlier, in January 2024, Russian state actors (Midnight Blizzard) reached Microsoft executive mailboxes through a forgotten legacy OAuth test application left with elevated permissions (Microsoft Security Response Center, January 25, 2024). Small teams recreate both hazards whenever staff connect Zapier, Make, n8n, or an AI agent using the founder's personal Google or Microsoft 365 login.

Enterprise vendors frame machine-identity governance as a six-figure platform purchase. In July 2026, Okta reportedly paid about $200 million for runtime startup Permiso to monitor what agents do after login (TechCrunch, July 30, 2026). Survey data shows why buyers worry. In ManageEngine's 2026 study (n = 515 IT and security decision-makers, ManageEngine, 2026), machine identities commonly outnumbered human staff 100 to 1, yet only 12% of surveyed organizations (n = 515) automated machine-identity cleanup. Separately, IBM's 2026 Cost of a Data Breach Report (n = 602 breached organizations, separate from IBM's 2025 study, IBM Security, 2026) found compromised APIs and plugins were an entry vector in 27% of AI security incidents across that n = 602 sample, while unapproved AI tools appeared in 43% of AI security incidents.

A 12-person firm needs no enterprise suite to end personal-account sprawl. Paired with our 10-question pre-connection check for Drive, Inbox, and Slack and our AI agent permission ladder, this guide translates federal controls and the OWASP Non-Human Identities Top 10 into the ed.cafe Small-Team AI Agent ID Card & 90-Day Service-Account Registry. Note that this guide offers general operational security practices, not legal counsel or a compliance audit.

What breaks when an AI agent borrows a human's personal login

Connecting an automation tool or AI agent through a human employee's Google Workspace, Microsoft 365, Slack, or CRM account causes three immediate structural failures: corrupted audit logs, inherited super-admin blast radius, and guaranteed offboarding outages. None of these failures triggers a warning during the five-minute OAuth consent screen.

Handing an AI agent your personal work login is like handing an overnight cleaning contractor your master key fob, alarm PIN, and HR cabinet key with your name stamped on the badge. Every hallway door entry at 2:14 a.m. prints your name on the security log. If you resign next quarter, cancelling your badge locks the cleaners out on Friday night, while keeping it active leaves an ex-employee's badge live. Where that physical key-fob analogy breaks down is speed and silent cloning. A brass key opens one door at walking pace. A stolen OAuth refresh token copied from a webhook tool can list 18,000 cloud files, read password-reset emails, and export an entire CRM table in four minutes from abroad without triggering a password prompt.

Federal security engineering codifies why shared human-machine logins fail. In NIST SP 800-53 Rev. 5 (NIST SP 800-53 Rev. 5 PDF), three baseline controls govern identity and logging:

1. Unique Identification (IA-2 and IA-4): Every human user and automated process needs a unique ID so actions trace to one actor. When n8n, Make, and an office manager all send mail as [email protected], logs cannot prove whether Sarah or a hijacked prompt sent a wire-change note.
2. Least Privilege (AC-6): Accounts may hold only the minimum permissions required for their task. Founders and operations leads usually hold Google Super Admin or Microsoft Global Administrator rights plus payroll folders. An OAuth token issued under Sarah's login inherits every folder she can open.
3. Audit Record Content (AU-2 and AU-3): Logs must record what happened, when it happened, and which distinct identity acted.

Blurred identity also stalls containment. Revoking Sarah's Google account during an alert locks Sarah out mid-crisis; leaving it active lets the attacker keep reading Drive. Isolating bot logins pairs directly with our first-hour AI incident response plan.

Mapping the OWASP Non-Human Identities Top 10 to a 15-person office

The OWASP Non-Human Identities (NHI) Top 10 (2025 release, OWASP NHI Project) catalogs how service accounts, API keys, OAuth tokens, and AI agents become breach paths. Six of its ten risks describe everyday shortcuts inside small offices using Zapier, Make, n8n, Claude Desktop, or OpenAI agents.

Press summaries sometimes cite vendor surveys without denominators. An ITPro report on a SANS Institute survey noted 74% of surveyed organizations deployed AI needing credentials and 92% of respondents failed to rotate credentials every 90 days (ITPro, 2026), though the public article omitted sample size n. Treat un-denominated survey stats as directional signals, and design against the concrete structural flaws in OWASP's taxonomy below.

Note why a shared admin@ inbox still fails NHI9 and NHI10. If twelve tools and three managers share [email protected] and one low-priority social plugin leaks its OAuth token, the attacker reads every SaaS password-reset email routed to ops@.

The blast-radius math: founder login vs dedicated agent account

Quantifying file, inbox, and offboarding exposure on a small-business tenant shows why spending $0 to $14 per month on an isolated agent login pays off immediately.

State the assumptions for a typical 14-person B2B services firm:

• Workspace setup: Google Workspace Business Standard ($14/user/month, or Starter at $7/month where eligible), Slack, HubSpot, and QuickBooks.
• Tenant data: 18,400 Drive files (420 HR, payroll, and W-9 records; 1,100 client contracts; 16,880 project files) and 64,000 archived emails in the operations director's inbox.
• Automations: Six workflows (Zapier invoice filer, n8n lead enricher, Make calendar brief, Claude MCP reader, support draft bot, KPI sheet updater).

Isolating [email protected] cuts Drive file exposure by 98.3% (18,400 files down to 320 files in this 14-person firm scenario) and shields 64,000 archived inbox threads from indirect prompt injection.

Platform-by-platform: creating a non-human login without enterprise IT

Every major office suite and developer tool offers free machine identities or low-cost starter seats you can configure in ten minutes:

1. Google Workspace: For scripts and n8n, create a free Google Cloud Service Account (IAM & Admin -> Service Accounts), leave Domain-Wide Delegation off, and share only one target Drive folder with its iam.gserviceaccount.com address. If Zapier or Make requires Google OAuth login, place a $7 to $14/mo user ([email protected]) inside a Non-Human Service Accounts Organizational Unit with 0 admin roles, enroll vault MFA in 1Password or Bitwarden, and share only that single folder.
2. Microsoft 365 / Entra ID: Register a free Entra App Registration using Sites.Selected so the bot reaches one SharePoint site rather than your whole tenant. If delegated login is required, use a non-admin svc-* seat restricted to one Teams channel.
3. Slack: Never use a human token (xoxp-). Build a Slack App at api.slack.com/apps, mint a narrow Bot Token (xoxb-), and invite the bot only to its target channel.
4. GitHub: Replace sweeping ghp_ tokens with Fine-Grained Personal Access Tokens (github_pat_) or a GitHub App scoped to one repo with a 30-to-90-day expiry.
5. OpenAI & Anthropic: Create one Project or Workspace per agent with its own API key and monthly hard dollar cap.

The ed.cafe Small-Team AI Agent ID Card & 90-Day Service-Account Registry

Copy the ed.cafe Small-Team AI Agent ID Card & 90-Day Service-Account Registry below into Notion, Google Docs, or your operations folder before switching any workflow from Draft to Active.

--- PART 1: BLANK AI AGENT ID CARD (COMPLETE BEFORE LIVE CREDENTIALS) ---
Agent ID & Login          : AGT-2026-[###] | [svc-<tool>-<task>]
Platform & Purpose        : [Zapier/Make/n8n/MCP] | [Narrow 1-line job]
Primary Human Sponsor     : [Name, Role, Email - accountable for output/spend]
Backup Human Sponsor      : [Name, Role, Email - takes over on PTO/departure]
Created / Next 90d Review : [YYYY-MM-DD] / [YYYY-MM-DD - max 90 days out]
Dedicated Principal       : [Exact svc-* email, GCP Service Account, or App ID]
Personal Login / Admin?   : [MUST BE "NO"] / [MUST BE "NONE" - 0 Admin rights]
Vault Secret Location     : [1Password / Bitwarden -> Vault -> Item Name]
Allowed Read Sources      : [Exact 1 folder, 1 Slack channel, or 1 DB view]
Allowed Write Actions     : [Draft-only / Append sheet row / Internal alert]
Prohibited Data Classes   : [No HR/Payroll, SSNs, W-9s, HIPAA PHI, Auth Resets]
Monthly Spend Hard Cap    : [$___/mo LLM API hard stop + platform run cap]
60s Kill Switch (1-3)     : (1) [URL to pause Zap/Scenario]; (2) [Admin Console
                            revoke path]; (3) [Manual fallback step for staff].

--- PART 2: FILLED-IN EXAMPLE (14-PERSON FIRM - INVOICE INTAKE AGENT) ---
Agent ID & Login          : AGT-2026-004 | svc-make-ap-intake
Platform & Purpose        : Make.com + Anthropic (Project: AP) | Parse vendor,
                            date, total from "AP_Drop_2026" PDFs to Sheet.
Primary / Backup Sponsor  : Maya Lin (Controller) / Devon Brooks (Ops Lead)
Created / Next 90d Review : 2026-10-29 / 2027-01-27
Dedicated Principal       : [email protected]
Personal Login / Admin?   : NO personal login | NONE admin roles
Vault Secret Location     : 1Password -> Ops_Service_Accounts -> AGT-2026-004
Allowed Read / Write      : Read "AP_Drop_2026" ONLY; append "AP_Staging" ONLY.
Monthly Spend Hard Cap    : $25/mo Anthropic hard cap; 2,000 Make operations.
60s Kill Switch (1-3)     : (1) Make -> "AP Intake" OFF; (2) GCP IAM disable key
                            + Anthropic delete key; (3) Clerk keys PDFs manually.

--- PART 3: 10-COLUMN REGISTRY HEADERS & QUARTERLY 15-MINUTE AUDIT ---
Columns: Agent_ID | Agent_Login | Runtime | Primary_Sponsor | Backup_Sponsor |
Systems_Touched | Permission_Rung | Secret_Created | Next_90d_Review | Status

Quarterly 15-Minute Check (First Monday of Jan / Apr / Jul / Oct):
[ ] 1. Did any Primary_Sponsor depart or change roles? Reassign + rotate secret.
[ ] 2. Zero runs in past 30 days? Disable credential and mark Status = Retired.
[ ] 3. Rotate static API keys >= 90 days old; update vault entry.
[ ] 4. Check Google Admin (API Controls) / Entra (Enterprise Apps): confirm 0
       automations sit under human staff personal OAuth connections.

Migrating existing founder-login automations in 60 minutes without downtime

Ripping out a founder's OAuth token all at once on a Tuesday morning breaks live forms and billing alerts. Run a four-step, 60-minute parallel cutover using the ed.cafe Small-Team AI Agent ID Card & 90-Day Service-Account Registry:

1. Minutes 00-15 (Export live OAuth grants): Open Google Admin (Security -> API controls -> Manage Third-Party App Access) or Microsoft Entra (Enterprise applications) and sort user-consented grants by broad scopes (Mail.ReadWrite, Drive, Full access).
2. Minutes 15-30 (Create svc-* logins): Start with your three highest-risk workflows. Provision their dedicated identities, share only the target folder or channel, and complete three ID cards.
3. Minutes 30-45 (Swap connections in parallel): Add the svc-* connection inside Zapier, Make, or n8n alongside the old one, repoint one workflow, and test three synthetic items. Fix 403 errors by sharing the single missing sheet rather than global Drive rights.
4. Minutes 45-60 (Revoke legacy grants and lock consent): Delete the founder's personal connection inside the automation tool and revoke the token at myaccount.google.com/permissions or myapplications.microsoft.com. Restrict Workspace API Controls so regular staff need admin approval for broad Inbox or Drive scopes, and pair quarterly checks with templates in the ed.cafe Staff Room.

Where this stops being true

Four boundaries require engineering controls and legal counsel beyond a spreadsheet registry:

• Scale past 50+ machine workloads: Manual 90-day static key rotation breaks down across dozens of microservices. Move CI/CD and cloud jobs to short-lived OIDC workload identity federation (15-to-60-minute auto-expiring tokens) under OWASP NHI7:2025.
• Legacy SaaS apps with $150+ seat minimums and no service principals: Where vendor pricing forces binding an API token to a human license, use a non-admin standard user seat, restrict role permissions, log the exception on the ID card, and require human sign-off on writes.
• Regulated records (HIPAA, GLBA, FERPA, 42 CFR Part 2): A svc-* login does not make Zapier, Make, or an LLM API compliant by itself. Verify signed Business Associate Agreements (BAAs), Data Processing Addenda, and zero-training terms with legal counsel first.
• Prompt and formula injection inside scoped folders: Least privilege shrinks blast radius, not gullibility. Strip leading =, +, -, and @ characters before writing untrusted PDF text into sheets, and keep human approval on payments or external email. Again, this guide provides general operational security information, not legal advice or a security audit.

Questions people ask

Key terms

• Non-human identity (NHI): A machine credential such as a service account, OAuth token, API key, or bot login used by software or an AI agent to access other systems.
• Principle of least privilege (NIST AC-6): The rule that every human or machine identity may reach only the exact folders, tables, and actions required for its narrow job.
• OAuth refresh token: A persistent credential issued after a "Connect Account" login that lets a third-party app mint new access sessions without repeating password or MFA prompts.
• Zombie service account (OWASP NHI1:2025): An orphaned automation account or static token left active after a pilot stops or its human creator departs the company.
• Service principal / service account: A headless cloud identity (such as a Google Cloud Service Account or Entra App Registration) built for automated software rather than human webmail.
• Human sponsor: The named current employee accountable for an AI agent's scopes, monthly spend cap, 90-day rotation, and emergency shutoff.

Sources

1. Google Threat Intelligence Group (GTIG), "UNC6395 Compromises Salesforce Instances via Salesloft Drift OAuth Tokens" (August 28, 2025): Google Cloud Threat Intelligence
2. Cloudflare Security Blog, "The Impact of the Salesloft Drift Breach on Cloudflare and Our Customers" (September 2, 2025): Cloudflare Blog
3. Microsoft Security Response Center (MSRC), "Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard" (January 25, 2024): MSRC Disclosure
4. TechCrunch, "Okta Buys AI Security Startup Permiso, Source Says for About $200M" (July 30, 2026): TechCrunch Report
5. ManageEngine, "Enterprise Identity Security 2026 Study (n = 515 IT and cybersecurity decision-makers)" (2026): ManageEngine Study
6. IBM Security, "Cost of a Data Breach Report 2026 (n = 602 breached organizations)" (2026): IBM Breach Report
7. OWASP Foundation, "OWASP Non-Human Identities (NHI) Top 10 Project (2025 Release)": OWASP NHI Top 10
8. National Institute of Standards and Technology (NIST), "Security and Privacy Controls for Information Systems and Organizations (SP 800-53 Rev. 5)" (September 2020; updated): NIST SP 800-53 Rev. 5 PDF
9. ITPro (citing SANS Institute survey), "Agent Identity Governance Can't Keep Up With Adoption Rates" (2026): ITPro Article