Agentic Identity
Service accounts, application programming interface (API) keys, personal access tokens, and OAuth grants piled up for years. Agents walked into that pile and started using all of it. Island inventories every non-human identity and governs their access.
The world’s leading enterprises run on Island.
.png)
.png)
.png)
.png)
.png)
Inventory tells you what exists. It doesn't tell you what's happening.
"Do these credentials exist?" isn't what keeps a chief information security officer (CISO) up. They need to know what credentials are actually being used, which agents are using them, and if that access is a risk.
The task ends. The credential keeps living.
An agent books a meeting on Google Calendar. To do it, it authenticates as the marketing team's service account, and for those few seconds it can do anything that account can do. Then the task finishes, the credential stays active, and most organizations hold no record of it.
A list cannot tell you what is running
Which credential is authenticating right now, and which agent holds it, are questions a static inventory has no way to answer.
Granted access and used access are different
Over-privileged access is hard to detect until something goes wrong. Identify it before an irreversible action is taken.
Shared credentials look like normal traffic
Two agents quietly using one identity obfuscate what's actually happening, which makes monitoring and investigations difficult.
How it works
Island Agentic Identity inventories all non-human identities, understands how and when they are used, and governs the identities appropriately.
Inventory what exists
Island reads the inventory directly from the systems that issue non-human identities: cloud consoles, source repositories, software as a service (SaaS) platforms, and AI tools, covering systems such as AWS, GitHub, and Salesforce.
Watch what runs
Island Desktop is on the endpoint, Island Network is on the wire, and the Island MCP Gateway sits on the tool-call path. When an agent uses a credential, one of those sees it. Every event ties back to the identity used and to the human responsible.
Close the gap
Island surfaces the fix for each finding: rotate the leaked key, disable the dormant identity, reduce the scope of over-privileged access tokens, untangle the shared credential. Use the MCP Gateway to issue time-bounded, properly scoped credentials.
The MCP Gateway holds the credential, so the agent never sees it
The Island MCP Gateway sits between every agent and the tools it calls. The gateway provides:
- Just-in-time access scoped to a single task, expiring when the session ends
- A cutoff that needs no rotation, so blocking an agent from Salesforce leaves the underlying key intact
- Private access to internal and legacy systems that have no public endpoint
- Direct access to the Model Context Protocol (MCP) servers an enterprise builds for its own systems
A live inventory of every non-human identity
Island pulls the inventory of what exists directly from the systems that issue non-human identities: cloud consoles, source repositories, SaaS platforms, and AI tools. It can identify:
- All MCP tool calls and actions taken
- Hardcoded keys found in local scripts and configuration files
- Both granted permissions and the access that is actually in use
- Shared credentials identified by the agents using them
Boundaries on what an agent can do with access
The gateway also enforces what an agent is allowed to do once it has access.
Per tool
An agent can be restricted to specific actions via an MCP server. For example, giving an agent read-only access to Salesforce.
Per action
Control actions based on their type, such as preventing an agent from being able to perform destructive actions.
Per actor
Provide different privileges to users and their agents. For example, full permissions to Gmail for the user, but read-only access for agents.
Governing the entire agentic lifecycle
Agentic Endpoint Posture, Agentic Identity, and AI Runtime Protection work together to govern the agent lifecycle, from prompt and resources to actions and responses.
FAQ
Any credential issued to something other than a person. Service accounts, API keys, personal access tokens, identity and access management (IAM) roles, and OAuth grants all qualify. Non-human identity sprawl predates agents by years. Agents made it urgent.
A component of the Island Enterprise Agentic Control Plane that shows which identity every AI agent is running as. It pulls the inventory of non-human identities from the systems that issue them, watches which credentials authenticate at runtime through Island's control points, compares granted access with actual use, and brokers credentials through the Island MCP Gateway so agents get access scoped to the task.
The non-human identity is the credential, such as a service account, an API key, or an OAuth grant. The agent is the actor using it. Several agents can share one credential, and one agent can use several. Governing the credential shows what access exists. Governing how agents use it shows who is exercising that access, for which task, right now. The Island MCP Gateway sits between the two as the control point.
Yes. Island Desktop parses local files and configuration files on the endpoint for embedded credentials, including keys hardcoded into scripts on a developer's laptop and secrets sitting in a local MCP server configuration. Tools built only on API connectors to cloud and SaaS systems cannot reach those, because there is no API to connect to. Each credential Island finds joins the same inventory as the ones issued through official channels.
Every non-human identity created across the environment: API keys, service accounts, personal access tokens, IAM roles, OAuth grants, and other machine credentials. Island pulls the inventory from cloud providers, source repositories, SaaS platforms, and AI tools through direct API integration, covering systems like AWS, GitHub, Salesforce, AI assistant platforms, and vendor compliance APIs. Island Desktop also parses local files and configs on the endpoint, so credentials hardcoded into scripts or MCP configs surface alongside the ones issued through official channels.
Island Desktop on the endpoint, Island Network on the wire, the Island MCP Gateway on the tool-call path, large language model (LLM) gateway integrations for organizations that already run one, direct API integrations with the cloud, source, and SaaS systems where identities get created, and vendor compliance API integrations for usage telemetry. Together they give both the inventory picture (what exists) and the runtime picture (what's running).
Runtime usage is inferred from telemetry at Island's existing control points. For example, a specific API key seen in a network request through Island Network gets correlated back to the identity record in the inventory. That correlation is what turns "the identity exists" into "the identity is doing this, right now, on behalf of this agent." An inventory pulled through an API connector alone can't produce it, because the usage happens somewhere the connector doesn't see.
Yes. Once an identity is in the inventory and its runtime activity is being observed, Island compares the access it was granted against the access it actually exercises, and flags identities whose granted scope has drifted far wider than their real usage. Over-privileged identities are one of the largest sources of blast radius when an agent is compromised or misdirected, and the gap is invisible without both data points.
Island integrates with identity providers like Okta and Microsoft Entra, and with application systems like Salesforce and GitHub, to surface recommended revocation and rotation steps from a single point of control instead of requiring a per-system cleanup. Whether a given action is executed directly or handed off to an admin depends on what the source system supports. The Island MCP Gateway also offers a distinct kind of remediation by cutting an agent off from a resource by blocking it at the gateway, without touching the underlying credential.
Island identifies static credentials in use through supported endpoint, AI provider, and identity provider sources, including the provider application programming interface (API) keys, service accounts, and agent identities that AI tools rely on. Once a key surfaces, supported MCP connections can move to the Island MCP Gateway, whose vault holds the credential and brokers access so the agent no longer needs the key. Revoking the original key is a separate, explicit step.
.svg)
.svg)
