Enterprise IAM assumes whoever’s on the other end of a login is a human. AI agents break that assumption, not with some clever new attack, but by walking straight through shortcuts we’ve always taken: screen-level permissions instead of API-level ones, one consent prompt per app, identity lifecycles tied to HR events instead of agent lifecycles.

Continue Reading