When an AI agent uses a human user’s credential to access databases, the system does not obtain a hidden “agent identity” behind the account; it sees the user themselves. This is the central conclusion of a measurement conducted by Naseeb Ahmed Mian on a production environment using Azure, Azure CLI, and sqlcmd.
In the setup under examination, the software agent’s skills connected to databases through the sqlcmd command using authentication through Azure CLI. The command extracted the access token cached after the user logged in, then presented it to the database. As a result, the connections appeared under the user’s name, along with their device name and the sqlcmd tool, regardless of whether the user wrote the query themselves or the agent executed it.
The Audit Log Sees the Credential, Not the Intent
The session log showed the user’s login name, workstation name, and client interface, but it contained no field distinguishing actions performed by the agent. Thus, human and automated queries became identical in the log, and subsequent controls could not apply a different request rate, approval step, or retention policy based on the source of execution.
The problem is not limited to security investigations. If a query executed months earlier is later challenged, the log will not establish whether the user wrote it or an automated tool ran it. It is accurate in attributing the action to the credential, but silent about the intent and the actual actor.
What Does the Access Token Reveal?
The token provided by Azure CLI contained the user_impersonation scope, in addition to a claim indicating that authentication included a multi-factor authentication factor. In practice, every action performed by the agent arrives with evidence that the user passed multi-factor authentication, even if that occurred hours earlier and in the context of a different task.
The token’s 84-minute lifetime also does not necessarily represent the end of the agent’s operation. The CLI automatically renews the token using a refresh token, so unattended operation may continue until the refresh token expires or the user’s account is disabled.
Group Membership Expands the Picture
An examination of role assignments showed only one row: the Reader role in a non-production subscription. But the access token included 37 groups, while a direct-membership query showed 34 groups, with nested groups present. Groups relevant to access included roles such as SQL Database Viewer, elevated-privilege user, resource contributor, and database administrator.
The danger is that these memberships may carry the actual permissions at the data layer and do not necessarily appear in control-plane role checks. Therefore, the agent’s access scope may appear limited when reviewed through the traditional method, while group membership grants it greater capability.
What Changes in Practice?
When the same identity was tested against two production stores one hour apart, two sharply divergent results appeared. In one, the identity had only CONNECT and SELECT permissions and could not connect to the secure layer. Another production analytics endpoint showed 430 tables and 107 permissions, including reading, writing, schema definition, and database administration.
The comparison shows that permission scope is not determined by identity alone; the access path, engine, and controls associated with the endpoint are also decisive factors. An endpoint may be read-only according to its documentation, while its security rules do not necessarily carry over when the data is accessed through another engine.
Editorial reading from certi.news: The problem is not that the agent is “without an identity,” but that the human identity was used as a quick substitute for an independent machine identity. This breaks down in three areas: attribution, permission breadth, and revocation. The measurement also showed that the environment in which the credential had deletion capability on a secure database was the only environment where audit logging was not enabled. Important questions remain open regarding the consistency of group membership, the persistence of temporary permissions within issued tokens, and organizations’ ability to record execution intent rather than merely the credential owner.