Standing credentials are long-lived or pre-provisioned secrets, tokens, or account rights that an agent can use without asking for fresh approval each time it acts. They may include API keys, OAuth refresh tokens, service accounts, or saved session credentials. In practice, they let automation move quickly, but they also create persistent access that can outlive the task that needed it.
In cyber security, standing credentials matter because they expand the blast radius of a compromise. If an AI agent is tricked by prompt injection or misconfigured permissions, those credentials can be used to send email, call cloud APIs, or alter SaaS data at machine speed. Defenders reduce the risk by giving each agent its own identity, scoping permissions tightly, rotating secrets, and making token revocation immediate so access can be cut off before the damage spreads.