Certifying the Machine Workforce: A Framework for Access Recertification of AI Agent Identities

Abstract

Access certification rests on three assumptions: a manager who can attest for each account holder, a human resources system that signals when access should change, and a population small enough for human review on a quarterly or annual cycle. AI agents break all three. An agent holds API scopes, tool permissions, and database credentials and can act on behalf of users, yet no manager can state what the agent did in the last quarter, no HR feed records a change in its capabilities, and agent populations grow at machine speed. Industry guidance now states that agent access requires certification, but no published design states how a certification campaign should run for agent identities: the review unit is not defined, the evidence a reviewer needs remains unclear, the events that should trigger a review are not specified, and the link between a revoke decision and confirmed removal is missing. The Agent Certification Framework (ACF) answers those questions by rebuilding the certification campaign identity teams already run. The framework certifies effective authority rather than direct grants, builds evidence packages from actual usage, fires event-triggered micro-certifications with the periodic campaign as backstop, assigns review jointly to a business owner and a technical custodian, checks separation of duties over agent capabilities, and ties every revoke decision to confirmed removal. The paper is conceptual and presents no experiments, datasets, or measured results. Contributions: (1) an analysis of why human certification designs fail for agent identities, grounded in current industry and standards literature; (2) the Agent Certification Framework (ACF), a conceptual model with seven components and a two-party operating model that adapts certification campaigns to agents; (3) a plain account of the framework limitations and a research agenda for the empirical work that should follow.

Download & deposit

© 2026 Prabin Shrestha. Licensed under CC BY-ND 4.0: share unchanged with attribution; no derivatives.

Cite this paper

@misc{shrestha2026machineworkforce,
  author = {Shrestha, Prabin},
  title = {Certifying the Machine Workforce: A Framework for Access Recertification of AI Agent Identities},
  year = {2026},
  month = {sep},
  url = {https://prabin-iam-ai-papers.pages.dev/papers/machine-workforce.html},
  note = {Research preprint, CC BY-ND 4.0}
}