BlueprintPage 19
19CORE PRODUCT
Agent Lifecycle Management
Treat agent permissions as temporary, reviewable authority—not permanent configuration.
- Priority
- P1
- Phase
- Phase 2
- Primary owner
- Platform / IAM
- Status
- Blueprint
Objective
Agents should have controlled birth, change and retirement processes just like employees and service accounts. Lifecycle automation prevents dormant agents, obsolete permissions and orphaned credentials from accumulating as organizations rapidly experiment with AI.
What to build
- Onboarding workflow from discovered → claimed → registered → verified → privileged.
- Approval gates for production promotion or access to sensitive systems.
- Periodic access recertification based on risk.
- Automatic suspension for owner departure, expired project, unused agent or policy violation.
- Retirement workflow that revokes credentials, disables tools and preserves evidence.
Implementation decisions
- Integrate HR/IAM signals for owner changes and departures.
- Integrate CI/CD so deployment versions update registry state automatically.
- Require re-approval when sensitive attributes change: model, tools, business purpose, data class or autonomy level.
- Support exception expiry so temporary permissions do not become permanent.
Definition of done
- No retired agent retains active privileged credentials.
- High-risk agents are recertified on schedule.
- Material configuration changes trigger required policy review.
Success metrics
- Orphaned-agent count
- Overdue recertifications
- Retirement completion time
- Temporary access expiry compliance
LIFECYCLE PRINCIPLE
Treat agent permissions as temporary, reviewable authority—not permanent configuration.