Issue agents just-in-time ephemeral credentials scoped per tool/dataset/action — not long-lived service-account keys
WorkOS·high signal
The 2026 pattern combines workload identity, intent-based authorization, and just-in-time issuance: the agent proves identity, requests only what the current task needs, then loses access when the task ends, using OAuth 2.1 short-lived tokens that expire in seconds-to-minutes rather than static API keys. Scope least privilege per tool, per dataset, per action — never one broad service account. This matters because GitGuardian found ~29M new hardcoded secrets in 2025 public commits, with AI-assisted commits leaking at roughly double the base rate.