Agent Lifecycle Management

Treat agent permissions as temporary, reviewable authority—not permanent configuration.

Priority: P1
Phase: Phase 2
Primary owner: Platform / IAM
Status: Blueprint

Objective

Agents should have controlled birth, change and retirement processes just like employees and service accounts. Lifecycle automation prevents dormant agents, obsolete permissions and orphaned credentials from accumulating as organizations rapidly experiment with AI.

What to build

Onboarding workflow from discovered → claimed → registered → verified → privileged.
Approval gates for production promotion or access to sensitive systems.
Periodic access recertification based on risk.
Automatic suspension for owner departure, expired project, unused agent or policy violation.
Retirement workflow that revokes credentials, disables tools and preserves evidence.

Implementation decisions

Integrate HR/IAM signals for owner changes and departures.
Integrate CI/CD so deployment versions update registry state automatically.
Require re-approval when sensitive attributes change: model, tools, business purpose, data class or autonomy level.
Support exception expiry so temporary permissions do not become permanent.

Definition of done

No retired agent retains active privileged credentials.
High-risk agents are recertified on schedule.
Material configuration changes trigger required policy review.

Success metrics

Orphaned-agent count
Overdue recertifications
Retirement completion time
Temporary access expiry compliance

LIFECYCLE PRINCIPLE

Treat agent permissions as temporary, reviewable authority—not permanent configuration.

This control is specified on page 19 of the blueprint.