---
title: "Identity and access · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/identity-and-access
updated: 2026-10-20
licence: "All rights reserved"
---

# Identity and access

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Sign people in through one identity provider, give every role the least it needs, keep no long-lived keys, and lock the root account away.

Most cloud breaches start with a leaked key or an account with too much power. These rules decide who and what can change the infrastructure. Keys inside the app and database users are covered in [Give each key the least power](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/least-privilege-keys) and the [app database role](https://agentwranglers.se/playbook/data/operations/app-database-role).

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/identity-and-access`.

## Required

- [Sign people in through single sign-on](https://agentwranglers.se/playbook/infrastructure/identity-and-access/single-sign-on-for-people): Give people cloud access only through the company identity provider, with two-factor login. Create no separate cloud user with a password for a person.
- [Keep no long-lived access keys](https://agentwranglers.se/playbook/infrastructure/identity-and-access/no-long-lived-keys): Use short-lived credentials for every person, pipeline and service. Delete every static access key, and alert when a new one appears.
- [Give every role the least it needs](https://agentwranglers.se/playbook/infrastructure/identity-and-access/least-privilege-roles): Write every role's permissions in code, limited to named actions on named resources. Never grant every action on every resource, except to the break-glass role.
- [Lock the root account away](https://agentwranglers.se/playbook/infrastructure/identity-and-access/lock-root-account): Protect every cloud root or owner account with a hardware key or passkey, give it no access keys, and alert on every sign-in.
- [Keep tested break-glass accounts](https://agentwranglers.se/playbook/infrastructure/identity-and-access/break-glass-access): Keep two emergency admin accounts that work when single sign-on is down. Store their factors offline, alert on every use, and test them twice a year.
- [Grant admin access for hours only](https://agentwranglers.se/playbook/infrastructure/identity-and-access/just-in-time-access): Give admin rights in production only on request, with a reason and an approver, for 8 hours at most.

## Recommended

- [Separate the roles for plan and apply](https://agentwranglers.se/playbook/infrastructure/identity-and-access/separate-plan-and-apply-roles): Give pull requests a read-only role that can only plan. Give the write role only to the main branch in a protected environment. Give the app its own runtime role.

- Previous: [Environments](https://agentwranglers.se/playbook/infrastructure/environments)
- Next: [Configuration and secrets](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets)
- [All chapters](https://agentwranglers.se/playbook/infrastructure)