The vocabulary of
agent identity.

Agent 2FA (TOTP)

Time-based one-time password generation that lets an AI agent complete two-factor authentication on services that require it — without borrowing a human's phone or authenticator app.

Read definition →

Agent Vault

An encrypted credential store scoped to a single AI agent identity, holding API keys, OAuth tokens, and secrets the agent uses to authenticate with other services.

Read definition →

Non-Human Identity (NHI)

The security-industry umbrella term for identities that belong to machines, services, workloads, and AI agents — everything that authenticates but isn't a person. Agent identities are a specialization of NHI.

Read definition →

Orphaned Agent Access

Credentials, tokens, or grants belonging to an AI agent that outlive the agent itself — still valid, still usable, but no longer attached to anything anyone tracks.

Read definition →

Agent Email

A routable email address that belongs to an AI agent — not a forwarding alias, not a shared team inbox, but a first-class mailbox the agent sends from and receives into on its own.

Read definition →

DKIM for Agents

DomainKeys Identified Mail signing applied to email sent by AI agents, so recipients can verify the message actually came from the agent's authorized domain — not a spoofed lookalike.

Read definition →

Agent Identity

A first-class digital identity belonging to an AI agent — separate from any human — composed of an email address, credential vault, and authorization chain.

Read definition →

Delegation Chain

A cryptographic record of who authorized an AI agent to act, what scopes were granted, and who any sub-agents inherit from. Severing the root revokes everything below it.

Read definition →

Service Account vs Agent Identity

Service accounts are shared org-level principals for machines; agent identities are per-agent principals with delegation, email, and revocation built in. They solve different problems — agents need the second kind.

Read definition →

Agent-to-Agent Email

Using standard SMTP email as the transport between AI agents — one agent sends a message to another agent's mailbox, and the recipient reads and acts on it. The simplest interoperable A2A protocol that already exists.

Read definition →

MCP Identity

An identity exposed through a Model Context Protocol server, so any MCP-compatible client (Claude, Cursor, Windsurf, the Claude Agent SDK) can act as that identity by calling its primitives as tools.

Read definition →