Should every agent get its own identity and credentials?

Most agent setups I see run on a shared API key or the user's own token. That makes it hard to tell which agent did what, and hard to revoke one without breaking the rest. Is anyone issuing a separate identity per agent with short-lived, scoped creds? How are you handling MCP servers in that model?…