I got pinged last week by an engineer deploying agents across their team. They'd built a smart customer-service agent that pulled from their CRM, updated account records, and sent follow-up emails. It worked great in testing. By day three in production, someone had realized the agent could delete customer records. Not "might be able to if conditions aligned." Could. Deliberately. They had to emergency-disable it.
This is not an edge case anymore. It's the production default.
The agent permission problem
Here's what makes agent governance different from traditional API access: agent execution is indirect and multiplicative.
When a human requests an API token, you know the scope: "read customer records" or "send email." Clear boundary.
