There are over 3,000 of them in The Shift’s vault, already vetted, ready to explore.

Subscribe and get instant access to the tool vault, a 1000+ prompt library, and free AI courses built for people with actual work to do. 

Plus, the daily newsletter that keeps you sharp on everything moving in AI in under 5 minutes a day.

They’re also giving away a free 1-year Claude Pro subscription to 3 subscribers. 

Subscribe for free to enter. All free. All in one place.

Subscribe to The Shift

-THE WIRE  THIS WEEK IN IDENTITY

N°01 · DISCLOSURE

In April 2026, Vercel disclosed a breach that had been running undetected since February. The chain started with an infostealer infection at Context.ai, a small third-party AI observability tool. Attackers used compromised OAuth tokens from Context.ai to pivot into a Vercel employee's Google Workspace account, then reached internal systems and exposed customer environment variables: API keys, database connection strings, webhook secrets, and cloud access keys that were readable to employees because nobody had marked them sensitive.

The breach ran for roughly two months before anyone noticed. Not because nobody was logging. Because no one was monitoring OAuth grant behavior at the tool level, and there was no correlation layer that could stitch the infostealer event, the OAuth compromise, and the internal access into one readable chain. Five systems. Three teams. A two-month window. The audit trail existed. Nobody could read it in time. That is the audit trail problem at enterprise scale, and it is exactly what this issue is about.

→ Vercel security incident bulletin

The alert fires at 2am. One of Marcus's agents, the one that reconciles vendor invoices against purchase orders, has been calling an external endpoint nobody recognizes. By the time the on-call engineer acknowledges it and loops in security, it is 6am. Someone senior walks in, reads the ticket, and asks the only question that matters. Show me what it did. Not what it was allowed to do. What it actually did, step by step, from the moment it woke up to the moment it went quiet. And this is where most organizations discover that they cannot answer.

Here is what actually happens next in a typical shop. The API gateway team pulls its access logs and hands over a list of inbound requests with timestamps and source IPs. The platform team exports traces from the observability stack, which show latency and spans but not identity. Someone with admin access to the LLM provider console downloads a usage report that shows token counts and model names, no prompts, no outputs. The identity team produces a record that the agent's service credential authenticated four times overnight, which is true and completely uninformative. And the tools the agent called, the invoice database, the payments API, the internal vendor directory, each keep their own logs in their own format on their own retention schedule. Five systems. Five clocks that are not perfectly synced. Five identifiers for what is supposed to be one actor. Nobody can put them in a line.

That is the audit trail problem, and it is structural, not a matter of someone forgetting to turn on logging. An agent session is not a single event that lands in a single system. It is a chain of actions that fans out across at least five planes: the gateway that received the trigger, the LLM provider that did the reasoning, the tools the agent invoked to act, the identity plane that issued and checked its credentials, and the observability layer that was supposed to be watching all of it. None of these planes were designed to talk to each other about a shared subject. Each is internally coherent and mutually illegible.

When people say they want a full session audit, this is what that phrase has to mean technically, whether or not they have said it out loud. It means request and response correlation, so that every action the agent took can be tied back to the specific reasoning step that produced it. It means tool-call chains that carry identity context at every hop, so that you can see not just that the payments API was called but which principal the agent was acting on behalf of when it made that call, and with what scope. And it means a session identifier that persists across all five planes, stamped on every event the moment the session begins and carried forward unbroken until it ends. Without that persistent identifier, correlation is archaeology. You are matching timestamps by hand at 6am and hoping two clocks agreed. With it, reconstruction is a query.

The gap between those two worlds comes down to a small set of events that an agent has to emit deliberately, at the moments that matter, in a form you can stitch together later. There are five of them, and each one closes a specific blind spot: the moment the session begins and takes on an identity, the moment it reaches for a tool, the moment it consults the model, the moment it exercises a credential against a real resource, and the moment it stops. Miss any one and the session has a hole in exactly the place a forensic investigator will need to look.

None of this requires waiting for a vendor to ship a unified agent-audit platform, and you should not wait, because that product does not exist yet in a form worth buying. The correlation layer is something you can build now with primitives you already run. Generate a session ID at the entry point, the gateway or the orchestrator, wherever the agent's work actually begins. Propagate it as trace context, the same W3C traceparent header your observability stack already understands, so it rides along on every downstream call the agent makes. Have each tool and each service log that ID alongside its own native record. Ship all five streams to one place, a log store or a SIEM, keyed on the session ID so a single query returns the whole chain in order. It is not glamorous work. It is plumbing. But it is plumbing you control, it is tool-agnostic, and it turns the 6am scramble into a saved search. The hard part was never the technology. It was deciding that agent sessions deserve the same forensic seriousness you already extend to human ones.

-THE IDENTITY 50  A LIVING WATCHLIST

On September 3, 2026, Cyera completed its roughly $1B acquisition of Oasis Security, folding one of the first purpose-built non-human identity platforms into a data-plus-identity stack aimed at the agentic enterprise. Watch the pattern next to this issue. Discovering and governing machine and agent identities is consolidating into the biggest platforms, and the replayable audit trail you are trying to stitch together by hand is exactly the capability these deals are buying.

→ Cyera completes Oasis acquisition · See the Identity 50

Think a vendor belongs on it? Reply to this email and tell me who.

Here is the question to carry back into your own environment before the next 2am alert makes it for you. Pick your most privileged agent, the one with the most access and the least supervision. What could you actually reconstruct about its last session right now, tonight, without asking three teams for exports? If the honest answer is a session ID and a clean replay, you are ahead of almost everyone. If the honest answer is five diaries in five languages, you already know what next week's work is.

Hit reply and tell me. I read every one.

See ya next week.