IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
The agent registry & kill switch
You cannot govern what you cannot see. Teams ship AI agents like Kai, and Zara in security ops needs a list of them all. Your goal: keep a registry of every agent, and stop any one of them fast.
- A registry shows each agent, what it may do and what it did.
- Build it from the audit ledger. Do not crawl databases.
- An agent with no rows may be bypassing governance.
- Give each agent step, spend and time budgets. A used-up budget stops it and raises an alert.
- The kill switch disables the agent's OAuth client. You can undo it.
Why a registry?
A company can have many agent identities: Kai, Bot A, an OpsBot and more. Each has some scopes, makes tool calls for users, and sits in a different team. So nobody can answer three questions in one place. Which agents exist? What can they do? What have they done? An agent registry answers them. It is an inventory of every agent identity and its behavior:
🪪 Identity
Every agent persona, and the OAuth client behind its token exchanges.
🎟️ Grant
The scopes each agent's token was really issued.
📊 Behavior
Calls made, calls refused, last active, and how many on-behalf-of exchanges.
❤️ Health
Does every agent run the current governance library, or is one falling behind?
The audit ledger is the registry
Do not crawl databases. Every governed tool call already adds one row to the audit trail, written by the guard. The row says which agent, which tool, the verdict and the library version. To build the registry, read that ledger and group the rows. Count when each row is written. Then the dashboard stays fast, however big the fleet grows.
Library drift and the kill switch
If each server embeds a shared library, servers can end up on different versions. That is library drift: an agent runs an old copy that lacks a control you shipped last week. Every audit row carries the library version. So the registry shows a ⚠ warning when a stale version appears. The fix is to put the current library back in.
To stop an agent now, use the kill switch. It disables the OAuth client that the agent uses to get its token by the on-behalf-of exchange. No new token means no new governed call. Tokens it already holds keep working until they expire. So keep tokens short-lived, or revoke them too.
The switch is scoped. It checks that the client is one you own, so the browser cannot make it disable something random. It is reversible. The exact grants are saved before removal and restored when you re-enable the client.
Budgets: a circuit breaker before the kill switch
An agent can do harm by being too busy, not only by being hacked. A loop can call a paid tool a thousand times overnight. So give every agent three budgets. A step limit caps the tool calls in one task. A spend limit caps the rupees per day. A time limit caps how long one task may run.
When a budget is used up, the circuit breaker trips. The agent stops, and an alert goes to Zara. Use the kill switch as the last resort, when a breaker is not enough.
A building has a visitor log and a master breaker. Every governed agent signs the log. Flip the breaker and none of them gets power. But an intruder who never signed the log is not in the register.
A rogue agent does not use the library, so it sends no telemetry and shows zero activity, forever. It is not idle. Nothing it does can be seen. Absence is the signal. This is the library-versus-gateway trade-off from the MCP lesson.
Go deeper: Agent identity: where the standards are going (October 2026)
Today an agent is usually an ordinary OAuth client. It often also has a workload identity, such as a SPIFFE ID (see SPIFFE and SVIDs). Standards written just for agents are still drafts.
- In September 2026 the IETF working group WIMSE took up
draft-ietf-wimse-aims, "AI Identity Management System". It replacesdraft-klrc-aiagent-auth. It defines no new protocol. It shows how existing standards fit together for agents. These include workload identity, token exchange (RFC 8693), CIBA, the Shared Signals Framework and transaction tokens. - OWASP's Top 10 for Agentic Applications was published in December 2025. It treats identity and privilege abuse as one of its ten main risks. It also lists rogue agents, which is the case the kill switch is for.
These are drafts and new documents, and details can change. Check the current version before you build on them. Sources: datatracker.ietf.org and genai.owasp.org.
🧪 Interactive lab — enable JavaScript to play with this one.
Want one pane of glass over your AI agents' identities and actions? See our services for agent governance and audit.