The coworker with no start date.

We keep evaluating the model and shipping the identity.

No one asks. They just do. There is no request, no review, no moment where somebody with a security title gets to weigh in, because from where the builder is sitting there is nothing obvious to review.

And there are no real gates, which is the part worth sitting with for a minute. A harness can simply impersonate a user to access data. It authenticates as a person, carries that person's session, and inherits every entitlement that person was ever granted, which means the access decision got made years ago by whoever provisioned the human.

Nothing new was requested. Nothing new was approved. The gate you believe you are standing at is a door somebody already walked through, holding it open.

The people building this way are not being reckless, and it matters that you understand why. They don't know how the rest actually works. They connect, they ask it questions, and if it answers they move on to the issue they were actually trying to solve. That is a rational way to work and I would do the same thing in their position.

It is also how every one of these connections gets made without one deliberate decision about scope, and how a dozen of them reach production before anybody writes down the word inventory.

No one thinks of the data pipeline spaghetti they are creating. Each connection is one line. The tenth one is still one line. Nobody is standing far enough back to see the shape, and by the time somebody is, the shape is load bearing and the people who drew it have moved on to other work.

API and MCP gateways offer some relief, and I want to be careful about how much. They have to be built, which is months. They are already aging in design, because the thing being gatekept changed twice while the gateway sat in review. And they slow things down, which in this climate is the objection that actually kills them.

The chokepoint is still the right shape and I would argue for it again tomorrow. I no longer think it arrives fast enough to matter on its own.

The FOMO is so bad that everyone is willing to look past design principles. Not quietly, either. People who would have stopped this cold two years ago are waving it through, because the cost of being the team that slowed down AI is a cost they can feel in the room, and the cost of the pipeline nobody drew is one they cannot.

Call the pattern borrowed authority. A new actor arrives, needs to reach something, and takes the access of whatever already had it. The actor is new. The authority is second hand, and it still carries the shape of the job somebody originally granted it to do.

This is old, and that is the useful part. A build server that could deploy to any environment, because scoping it per environment meant a ticket per environment and nobody had the appetite for that many tickets. The monitoring account with read everywhere because narrowing it meant a conversation with every data owner. Somebody created a shared admin credential once and four people ended up using it.

Every one of those is the same move. Somebody needed access, somebody else already had it, and the path of least resistance ran straight through the credential that existed.

What changed is the arithmetic. A person borrowing a credential is one decision, made once, by someone who could be asked about it later. An agent borrowing one is a decision that executes a few thousand times a day without anybody deciding again, and it executes against whatever the credential could always reach rather than whatever the agent was built to do.

Your environment does not see a model. It sees whatever identity that model borrowed, and that identity is carrying a blast radius somebody set during a demo.

Watch this land during an incident, because that is where the abstraction stops being an abstraction. The audit log names the service account. It cannot tell you which agent acted, under whose direction, or whether a human asked for any of it. Three agents share the credential, so revoking it to contain one takes down the other two, and the first ten minutes of the investigation go to finding the person who built the thing rather than stopping it.

The impersonation case is worse and it is the more common one. The log names a person. It shows their account reading everything that account was ever entitled to read, at an hour they were asleep, and the honest explanation is that a harness was running on their behalf against data nobody scoped. That is a sentence you do not want to be assembling for the first time with a regulator waiting on it.

Here is what makes the wrong version so appealing, and I want to spend a minute on it because most of us are living in it right now. Model risk work is board legible. You can put a benchmark on a slide. There is a vendor category, an analyst quadrant, a conference track, and a hiring pool of people who actively want to work on it.

The authority work produces a spreadsheet, and the spreadsheet says your identity hygiene is worse than what you told the audit committee last year, in writing, with a date on it. One of those is a program you can announce. The other is a confession you have to schedule.

So the evaluation work gets funded and the plumbing does not, and both decisions look reasonable in the room where they get made. That is usually how the expensive version of a problem arrives. Nobody chose it. A dozen people each chose the thing in front of them.

The teams handling this well are not doing anything clever. They treat an agent the way any of us would treat a contractor showing up on Monday morning with a laptop and a list of systems they say they need.

Who is this. Who owns them. What do they need to reach, and what happens to the access when the engagement ends.

That intake takes twenty minutes and it happens before the agent is in production, which is the entire difference between those teams and the rest of us.

Which is why this week's move is small. One agent, three answers. Find out what one of those connections actually granted, while the number is still countable.

Start with the agent holding the most access rather than the one carrying the most importance. Those are rarely the same agent, and the gap between them is itself worth understanding. Scope the credential to the three answers, put a named human on it, and give it an end state, a date or a condition that retires it.

The second order effect shows up somewhere you were not looking. Once one agent has an identity of its own, your detection content can finally separate agent activity from human activity, and every behavioral baseline you have been trying to build on top of a shared service account starts to mean something. You were not trying to fix detection. You fixed it anyway, because a signal nobody can attribute was never a signal.

It gets hard in three specific places, and you should know about all of them before you start. The first is the vendor copilot that authenticates as your whole tenant, where there is no per agent credential to issue because the vendor never built one. You cannot solve that with a ticket. Write down that the scope is the tenant, put it in the risk register under the vendor's name, and carry it into the renewal conversation, which is the only place it can actually be solved.

The second is the harness that runs as a person, where there is no separate credential to scope because the agent never had one. You cannot fix that at the identity layer this week. Write down that the agent's authority equals that user's authority, then go read that user's entitlements, because those are now the real finding and they were probably the real finding before any of this started.

The third is ownership.

Nobody volunteers.

The name you write down will usually be whoever built it, and there is a decent chance they have moved teams since, which tells you something about how long the thing has been running unowned. Write the name anyway. An owner who is surprised to find out they own something is still an owner, and that conversation is far cheaper this week than during an incident.

We built fifteen years of lifecycle for people. The next fifteen belong to everything else.