GOV-05: Short-lived credentials
In short: Issue agents credentials that expire within minutes or hours and are scoped to a task, instead of static keys or long-lived tokens. A leaked static key works until someone notices. A short-lived credential expires on its own, which shrinks the window for theft and replay.
What does GOV-05 require?
Issue agents credentials that expire within minutes or hours and are scoped to a task, instead of static keys or long-lived tokens.
Why does it matter?
A leaked static key works until someone notices. A short-lived credential expires on its own, which shrinks the window for theft and replay.
How do you test it?
- List the credential types agents hold and their lifetimes.
- Search code and vaults for static keys issued to agents.
- Replay an expired agent token and confirm it is rejected.
Which platforms document GOV-05?
Documented by NewCore, Astrix Security, Cyera Identity, Descope, Aembit and Idira.
- 9.10NewCore documentedSource: NewCore: Secure, read
- 7.30Astrix Security documentedSource: Astrix at RSAC 2026, read
- 7.30Cyera Identity documentedSource: Oasis Agentic Access Management, read
- 6.85Descope documentedSource: Descope Agentic Identity Hub, read
- 6.55Aembit documentedSource: Aembit home, read
- 5.50Idira documentedSource: CyberArk Secure AI architecture docs, read
- 8.35Silverfort partly documentedSource: Silverfort: AI Agent Security, read
- 6.55SailPoint Entro partly documentedSource: SailPoint agentic AI security, read
- 6.35Clutch Security partly documentedSource: Clutch Security platform, read
- 6.55Token Security not found in public materialChecked: Token Security home, read
Which framework references apply?
No framework mapping is confirmed for this control yet. See the framework crosswalks for what we checked.
Which controls are related?
Glossary: non-human identity, just-in-time access, short-lived credential, standing privilege.
Reviewed by The Register desk