What is Credential Decay?
Operations (LLMOps & AgentOps)The drift type where tokens, keys, and service accounts outlive the scope they were issued for. Access meant for a pilot stays active in production months later, expanding the blast radius a little at a time.
Why It Matters
Agents hold credentials humans do not: database tokens, API keys, CRM access, issued for a task and then forgotten. The Gravitee 2026 survey found enterprise agent fleets roughly double per quarter while only about 20% of teams individuate agent identities. Pilot projects end; the service accounts keep working. Every one of those lingering credentials is standing access with no owner watching it, and each one quietly widens the blast radius of whatever goes wrong next.
The Dark Matter Properties
No owner. The person who requested the credential moved on, and nobody inherited the access it granted.
No scope. The token was issued broadly because scoping took effort, so its reach far exceeds its purpose.
No expiration. Nothing ends the credential, so access meant for a pilot is still live in production quarters later.
No review. The credential appears in no access review because it belongs to a non-human identity nobody inventories.
Where It Breaks
Shared credentials are the compounding failure: multiple agents on one service account means no per-agent audit trail, and revoking the credential breaks every agent at once, which is why nobody revokes it. Per-instance identity is what makes revocation cheap enough to actually happen. The other break is inventory: teams cannot decay-check credentials they never catalogued, and agent credentials are routinely issued outside the IAM review humans go through.
How Flytebit Handles It
Credentials in our deployments are scoped per environment, resource, and verb with short lifetimes, and the quarterly access review in the maintenance cadence audits every credential against a live agent inventory. The dark-matter problem and the rotation cadence are covered in Operating Agentic AI Systems, and the operating model is our LLMOps work.