Identity first

Every agent is a non-human identity. Vettly treats it like one.

An agent reads data, calls tools and acts on behalf of people, with credentials of its own. That makes it an identity in your estate, whether or not it has a row in your directory. Vettly gives each agent a stable, accountable identity and reviews the identity questions a security team asks of any principal: who is it, who owns it, who can drive it, how does it authenticate, what can it act as, and who can change what it does.

• A stable identity and an accountable owner · Per-tenant IDs (VT-0017), platform-native references, a named owner, team and business unit. Unowned agents discovered on a platform are flagged unclaimed until someone takes responsibility.
• Who can drive it · Principals and audiences, their size, whether they are external or public, and which of them are privileged. Audience is a first-class input to blast radius and to loss frequency.
• How it authenticates · None, password, SSO, SSO with MFA or API key, judged against the sensitivity of what the agent can reach. Weak authentication in front of restricted data is a finding, not a note.
• What it can act as · Identity-category tools such as resetting passwords, granting group membership or issuing tokens are scored as privileged actions; approval gates and scope on those tools are checked explicitly.
• Who can change it · Instruction editors (owner, admins, anyone) and MCP servers that hold secrets are part of the identity surface: a prompt anyone can edit is a credential anyone can forge.
• Proof that it was reviewed · The attestation binds the identity to the exact configuration that was blessed. A new version or drift makes the proof visibly stale.