Which tools issue and revoke permissions for non-human workers like agents, bots, and automations?

Tools that issue and revoke permissions for non-human identities (NHI)—agents, bots, service accounts, and automations—generally fall into these categories:

• Identity governance / IAM: Microsoft Entra Agent ID, Okta, and similar platforms can give agents distinct identities, assign scoped roles, perform access reviews, and revoke access. Microsoft specifically recommends treating each agent as a first-class principal with lifecycle-managed identity and RBAC.Microsoft+1
• Agent authorization gateways: Permit.io MCP Gateway lets administrators grant, modify, and revoke an individual agent's access to MCP servers.Permit.io Docs
• Tool-permission policy engines: Azure SRE Agent's tool access policies control which tools an agent can invoke and whether execution requires approval; permissions can be scoped globally, per agent, or per thread.TECHCOMMUNITY.MICROSOFT.COM
• Cloud/API authorization: Cloudflare's NHI controls combine principal identity, OAuth visibility, scoped RBAC, and automated revocation for agents, scripts, and third-party tools.Cloudflare Blog
• Agent/tool runtimes: Systems such as GitHub Copilot CLI can grant/deny individual tools and reset previously granted permissions; this is more execution-level permissioning than enterprise identity governance.GitHub Docs

A useful way to think about the landscape is:

Identity → entitlement issuance → runtime/tool authorization → audit → revocation

For enterprise-wide NHI governance, the first category is the control plane; agent gateways and tool-policy engines enforce the permissions at runtime. Microsoft explicitly recommends testing the revocation path—disabling the identity, rotating credentials, and removing stale permissions—as part of agent governance.Microsoft

If you're looking for specific vendors/products that specialize in issuing and revoking NHI permissions, rather than general IAM or agent platforms, I can give you a focused market map.

Tools that issue, manage, and revoke permissions for non-human workers—AI agents, bots, service accounts, and automations—generally fall into a few categories:

• Identity & access management (IAM/IGA): Platforms such as Microsoft Entra ID and Okta can give agents dedicated identities, assign scoped roles, manage their lifecycle, and revoke access. Microsoft explicitly recommends treating agents as first-class principals with lifecycle-managed identities and least-privilege RBAC.Microsoft+1
• Authorization / policy engines: Tools such as Permit.io can distinguish humans from agents, assign agent-specific trust/permissions, and revoke an individual agent's access without necessarily affecting other agents belonging to the same human.Permit.io Docs
• Non-human identity (NHI) security platforms: These focus specifically on machine identities, credentials, OAuth grants, scoped RBAC, and automated revocation. Cloudflare, for example, describes managing agents, scripts, and third-party tools as non-human identities throughout their lifecycle.Cloudflare Blog
• Agent/tool policy gateways: These sit between an agent and its tools/APIs and enforce which tools it may invoke and under what conditions. Microsoft's Azure SRE Agent, for example, has tool-access policies with Allow/Ask controls and global, agent, and thread-level scopes.TECHCOMMUNITY.MICROSOFT.COM
• Agent-specific governance platforms: Products such as Scaled Agents combine worker identity, least privilege, human approval, action-time authorization, monitoring, and evidence in one control layer.Scaled Agents

A useful architecture is:

Identity provider → authorization/policy engine → agent/tool gateway → downstream systems

The identity layer answers “who is this worker?”, the policy layer “what is it allowed to do?”, and the gateway “is this particular action permitted right now?” Revocation should invalidate the worker's credentials/entitlements and be enforceable at runtime—not merely remove it from a configuration list.Microsoft+1

If you're looking for specific products/vendors that specialize in issuing and revoking permissions for AI agents, rather than general IAM systems, I can give you a current vendor landscape.

Managing permissions for non-human identities (NHIs)—like AI agents, bots, service accounts, API keys, and CI/CD pipelines—is usually referred to as Non-Human Identity Management (NHIM) or Machine Identity Management.microsoft.com+1

Because non-human workers pop up constantly across code repositories, cloud platforms, and SaaS apps, specialized security and IAM platforms have emerged to discover, scope, and revoke their access.oneidentity.com+1

The leading tools handling non-human identity lifecycle and permission revocation include:

• Astrix Security (Astrix Security ) - A dedicated Non-Human Identity (NHI) security platform that maps out third-party integrations, service accounts, and AI agents across SaaS, PaaS, and IaaS environments, letting you spot over-privileged access and revoke credentials safely.astrix.security+1
• Oasis Security (Oasis Security ) - Designed specifically to secure non-human identities and AI agents across complex enterprise architectures (AWS, GitHub, Salesforce, Copilot, etc.), offering automated discovery and governance over automated access.oasis.security
• Akeyless (Akeyless ) - A secrets management and NHI platform that provides dynamic, just-in-time (JIT) ephemeral credentials and automated rotation/revocation so machines don't retain permanent, standing privileges.akeyless.io+1
• One Identity (One Identity ) - Offers comprehensive identity governance (IGM) and privileged access management (PAM) tailored to onboard, govern, and retire AI agents and workload identities with the same rigorous policy controls used for humans.oneidentity.com+1
• Microsoft Entra / Microsoft Security (Microsoft Security ) - Enterprise cloud IAM features that provide centralized visibility, policy-based access control, and lifecycle automation for application service principals, managed identities, and bots.microsoft.com
• Okta (Okta ) - Provides foundational identity and API access management tools to monitor, scope, and revoke tokens and credentials tied to service accounts and automated apps.oneidentity.com

If you're dealing with a specific environment, tell me:

• Are these AI agents / LLMs , or traditional service accounts / API keys?
• Which platforms are they accessing (AWS, GitHub, Salesforce, custom apps)?

I can help narrow down which tool fits your stack best.

If you mean identity/access-management tools that can issue, scope, monitor, and revoke permissions for non-human identities—including AI agents, bots, service accounts, and automations—the main categories are:

• Microsoft Entra Agent ID / Entra ID Governance — dedicated agent identities, access packages, RBAC, Conditional Access, lifecycle management, and disabling/revoking agents.Microsoft Learn+1
• JumpCloud Agent Identities — gives AI agents separate identities with owners, group-based access, application permissions, auditing, and independent revocation.JumpCloud
• Cloud IAM / workload identity systems — AWS IAM, Google Cloud IAM, Azure RBAC, workload identities, managed identities, and service principals can issue and revoke authorization for workloads and automations.
• PAM / secrets-management platforms — tools such as CyberArk, HashiCorp Vault, and cloud secret managers control credentials, rotation, short-lived tokens, and emergency revocation.
• OAuth authorization / entitlement-management systems — issue narrowly scoped, time-limited permissions and revoke grants or tokens when an agent's authorization changes.
• Agent-specific authorization/control planes — newer products are emerging specifically around agent identity, tool authorization, delegation, and runtime revocation. The key distinction is that these should revoke the agent's effective authority, not merely delete one API key.AgentID

For AI agents specifically, Microsoft Entra Agent ID is currently one of the clearest examples of a platform treating agents as first-class non-human identities: it supports access packages, inherited permissions, Conditional Access, sponsors/owners, lifecycle management, and disabling individual or groups of agents.Microsoft Learn+1

If you're asking because you're looking for vendors/products in this emerging “non-human identity / agent IAM” category, I can also give you a comparison of the leading tools and what each one actually issues and revokes.

Specialized Non-Human Identity Management (NHIM) and Identity Security Posture Management (ISPM) platforms issue, manage, and revoke permissions for non-human workers like AI agents, bots, service accounts, and API tokens.oneidentity.com+2

Specialized NHI & Agent Security Platforms

• Astrix Security: Maintains real-time discovery and inventory of AI agents and machine identities, allowing security teams to automatically revoke excessive privileges or remove unused tokens.akeyless.io+3
• Oasis Security: Discovers and governs the complete lifecycle of non-human identities across SaaS, cloud vaults, and CI/CD pipelines to enforce automated remediation.akeyless.io+1
• CrowdStrike Falcon Identity Security: Discovers and classifies non-human entities and dynamically enforces least-privilege rules by revoking sessions or blocking anomalous machine behavior.youtube.com+1

Enterprise Identity Providers & Vaults

• Okta Privileged Access: Vaults secrets and automates risk scoring, credential rotation, and policy enforcement for non-human accounts.
• HashiCorp Vault: Dynamically generates, manages, and expires on-demand credentials and access tokens for automated workloads and cloud services.
• CyberArk Conjur Cloud: Provides machine-native authentication and governance for microservices, containers, and automated workloads.oneidentity.com+2

If you'd like, let me know:

• Are you looking to manage AI agents in code/SaaS or infrastructure service accounts?
• Do you need an automated posture management tool or a secrets vault?