Your AI agent just provisioned a resource. Who owns it?

A cloud account can end up full of resources that were created by an agent and tagged with an owner like deploy-agent. That sounds tidy until you realize the tag points to something that has no badge, no inbox, and no last day. Once the task is done, the context window closes and the thing it built may keep sitting there, quietly burning through budget.

The basic fix is not exotic: find the non-human owners, stop them at review time, and make sure nothing gets created without a real owner attached. CloudQuery can already inventory assets by owner tag, so the trick is to compare that tag against your identity systems and flag anything that resolves to a role or service principal instead of a person. AWS and Azure make that relatively direct because their native records can confirm machine identities. GCP is messier, so the check there runs the other way around: if the owner is not in the company’s directory of actual employees, it is not a human.

Then comes the harder part, because env0’s default behavior treats the creator of an environment as its owner. That made sense when people were the only ones creating environments. It no longer does. The policy in the article changes the gate so every taggable resource must have an owner, that owner must look like a person’s email address, and it must not match the list of known agent identities. If that identity list goes missing, the policy fails closed.

The key point is that the key matters. env0 API keys default to the Admin role, and TTL limits do not apply to admins, so agents should get User-type keys scoped to one environment, not broad personal access or shared tokens. The agent CLI follows the same idea: one scoped identity per agent. No shortcuts.

TTL is the cleanup crew for what agents already left behind. env0 warns an environment’s creator three times before destruction, but that only helps if a person can actually act on the warning. So the article’s answer is blunt: let a person create the environment, let the agent deploy into it, and set a TTL so abandoned resources do not linger forever. Some platforms are already leaning that way, with Axiom letting an agent spin up a working account and deleting it automatically if nobody claims it within twenty-four hours.