An agent with credentials is a user

Most agents in production act with a person’s permissions, inherited through a session or a service account nobody reviews.

The detail

That makes them users, in every sense that matters to an auditor, without any of the joiner-mover-leaver process we apply to people.

Observability is the first step: you cannot govern an actor you cannot enumerate.

Quote Example