GOV-12: Decommission at task end
In short: Remove an agent's identity, credentials and access as soon as its task or project ends, and record when that happened. Finished agents that keep their access become unowned standing privilege. They are the agent version of the forgotten service account that attackers love.
What does GOV-12 require?
Remove an agent's identity, credentials and access as soon as its task or project ends, and record when that happened.
Why does it matter?
Finished agents that keep their access become unowned standing privilege. They are the agent version of the forgotten service account that attackers love.
How do you test it?
- Find agents with no activity in the last 30 days.
- Check whether each one still holds credentials.
- Confirm decommissioned agents have a dated record.
Which platforms document GOV-12?
Documented by Cyera Identity.
- 7.30Cyera Identity documentedSource: Oasis Agentic Access Management, read
- 9.10NewCore partly documentedSource: NewCore: Secure, read
- 6.35Clutch Security partly documentedSource: Clutch Security platform, read
- 8.35Silverfort not found in public materialChecked: Silverfort: AI Agent Security; Silverfort unveils AI Agent Security; Silverfort and Google Cloud Agent Gateway; Silverfort pricing, read
- 7.30Astrix Security not found in public materialChecked: Astrix at RSAC 2026; Astrix product; Cisco and Astrix Security, read
- 6.85Descope not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- 6.55Aembit not found in public materialChecked: Aembit home; Aembit IAM for Agentic AI is generally available; Aembit pricing, read
- 6.55Token Security not found in public materialChecked: Token Security home, read
- 6.55SailPoint Entro not found in public materialChecked: SailPoint agentic AI security; SailPoint closes Entro Security acquisition, read
- 5.50Idira not found in public materialChecked: Palo Alto Networks introduces Idira; CyberArk Secure AI architecture docs; Palo Alto Networks completes CyberArk acquisition, read
Which framework references apply?
No framework mapping is confirmed for this control yet. See the framework crosswalks for what we checked.
Which controls are related?
- GOV-01Agent inventory
- GOV-11Revocation and kill switch
- GOV-15Periodic access review
Glossary: just-in-time access, standing privilege, decommissioning.
Reviewed by The Register desk