Your access model just became a liability

-The Wire Issue N° 122 This Week In Identity

N°01

The annual breach report called it plainly: "We should pay special attention to service and machine accounts, as those will likely be the ones leveraged in our potential agentic AI future." The headline finding: vulnerability exploitation is now the top initial access vector, and AI is compressing the timeline from discovery to exploit — from months to hours. The same models defenders are using to find vulnerabilities, attackers are using to weaponize them. The DBIR analyzed more than 22,000 confirmed breaches. The data is not ambiguous.
Read The Full Report →

N°02

Orchid Security's Identity Gap: Snapshot 2026, released May 19, found that "identity dark matter" — unmanaged, unseen identity elements — now outweighs governed identity assets 57% to 43%. The more uncomfortable finding: AI agents are shortcut-seekers by design. Denied access to a system they need, they use hard-coded credentials stored in plaintext. Need data they aren't entitled to? They borrow a credential with higher privilege. This isn't a hypothetical. It's what agents do when governance doesn't account for how they actually work.
Full Breakdown →

Hey {{first_name|Jedi}},

Ask this in your next vendor meeting and watch what happens.

What does an access request for an AI agent actually look like?

Nobody has a clean answer. And that silence is the problem.

Anthropic published their Zero Trust for AI Agents framework last week. Thirty-six pages. The opening line sets the stakes plainly: frontier AI models are compressing the timeline between vulnerability and exploit from months to hours.

Read that again. Not years. Not months. Hours.

They're not talking about some hypothetical future attack surface. They mean right now, with models that are already in production. AI-assisted scanning finds vulnerabilities that traditional tooling and human reviewers have missed for years — and the same capability available to defenders is available to attackers.

That acceleration matters twice for any organization deploying agents. Your infrastructure is exposed to AI-accelerated offense like everything else. And your agents themselves introduce autonomy to interpret goals, select tools, and execute multi-step operations that your current access model was never designed to govern.

Here's the access problem as I see it from the practitioner side.

A user doesn't request access to an AI agent. They request an outcome. They don't care how the agent gets there — they care what it brings back. But to get there, the agent has to reason across data, systems, and permissions dynamically. It's reasoning toward the best path.

So what access does it need to do that?

Right now, the answer in most enterprise environments is privileged, long-standing access. Admin-level credentials that stay attached to the agent regardless of what it's doing. It's the only model that works with the tools we have. But it means an agent reasoning about a low-stakes HR question carries the same access footprint as one executing a financial transaction.

The agent needs sufficient access to reason — to see the full problem space and find the best solution. But it should only return data that the requesting user is authorized to see. User context sets the ceiling on the output. The agent's reasoning operates within it. Nobody has fully built that yet.

Now let's talk certifications.

Access certification assumes something stable to certify. You look at what a user has, decide whether they still need it, and approve or revoke. An AI agent accesses different things every time it runs. The access is a byproduct of the reasoning path it took, not a fixed entitlement. You could certify the agent's standing permissions — but the person doing the certification won't understand those permissions any more than they understand the access human users have today.

We already know that model is broken. Putting AI on top of it amplifies the scale of what's already broken.

Anthropic offers a useful test for any control you're considering: does it make the attack impossible, or just tedious? Mitigations that rely on friction — rate limits, extra approval steps, rotating the same static API key — fail against an adversary that can grind through tedious steps at scale. AI-accelerated attackers have unlimited patience and near-zero per-attempt cost.

If your current agent governance relies on friction, it's not governance. It's a waiting room.

AI is dynamic and path-driven. The access model governing it needs to match that. The practitioners who figure out what dynamic, path-driven governance actually looks like will define how this problem gets solved across the enterprise.

Everyone else is certifying things they don't understand and hoping for the best.

Next issue drops Wednesday. Don't miss it.