Giving an agent access to your systems takes one API key. Knowing exactly what it can touch, and on whose behalf, is a much harder problem. As agents connect to more tools through MCP and act for different users, shared service accounts and long-lived keys quickly turn into a security gap. How do you give every agent the access it needs for the task, and nothing more? This session breaks down how to treat agents as first-class non-human identities, covering delegated authorization with OAuth, per-tool scoping at the gateway layer, and short-lived credentials that expire with the task. Through practical reference architectures, it shows how to keep a clear chain of custody from user to agent to tool, so every action is attributable and auditable. Key takeaways: → How to issue and manage identities for agents, not just the people using them → Patterns for delegated auth and per-tool permission scoping across MCP servers → Building audit trails that tie every agent action back to a user and a task