The security industry has decided that the first big problem with AI agents is identity, and it is right. Agents are multiplying inside enterprises faster than anyone is tracking them, many of them acting through service accounts and borrowed human credentials, and you cannot secure what you cannot see. Non-human identity became a category almost overnight, and it deserved to.
But identity is where the work starts, not where it ends. Knowing which agent took an action tells you who. It does not tell you what that agent was allowed to do, under what conditions, or for how long, and that is the question security and risk leaders are actually losing sleep over. An agent can be perfectly identified and still do something it was never meant to do.
Identity is a directory. Authority is a control plane.
This is the distinction we think the market is about to learn the hard way. Identity is a directory. Authority is a control plane. A directory tells you an agent exists; a control plane governs what it is permitted to do. Enterprises that invest only in inventorying their agents will end up with an accurate, well-attributed list of everything that went wrong.
The reason it matters now is speed. A person with the wrong access is limited by how fast a person can act. An agent with the wrong authority is limited by nothing. The distance between “we know this agent exists” and “we control what this agent can do” is where the next decade of enterprise incidents will live.
Identity answers who. The harder and more valuable question, the one that decides whether an enterprise can put agents anywhere near money, customers, or regulated data, is what they are allowed to do. Who is necessary. What is the point.