Identity and authorization
Who is the agent, which systems can it access, and which actions is it permitted to perform?
The execution integrity gap
Agents can be authorized — and still be wrong.
Identity, permissions, and tool-call controls answer whether an agent can act. They do not fully answer whether the facts and system states it depends on are true, or whether the workflow is safe to continue.
What existing controls answer
Success at one layer can hide failure at the next.
An agent may use the correct identity, call an approved tool, receive a successful response, and still leave the intended outcome incomplete.
Behavior and tool use
Is the agent overprivileged, off-task, or calling an allowed tool in a dangerous way?
Verified reality
Did the required outcome actually happen, and are the conditions for the next workflow action now true?
A simple failure pattern
Provider success is not workflow proof.
An agent is asked to power on a cloud machine. The provider reports that the asynchronous action completed, but the resource itself is still off. If the next action continues from the response alone, the workflow now depends on something that is not true.
The dangerous part is not necessarily malicious behavior. It is a valid action followed by an invalid assumption.
AgentPower on machineREQUESTED
ProviderAction status: completedSUCCESS
RealityMachine state: offDIVERGED
WorkflowDependent action must not continueHOLD
Why this grows with autonomy
Every unverified dependency can propagate through the workflow.
Autonomous systems increasingly coordinate multiple tools, systems, agents, and persistent memories. A wrong state early in the trajectory can become the assumed foundation for every action that follows.
Stale or partial state
The agent observes a state that has changed, reads only one part of a multi-system outcome, or treats eventual consistency as completion.
Misleading success responses
A provider acknowledges an operation or completes a control-plane action without proving the downstream resource condition.
Unverified handoffs
One agent passes a claim to another, and the receiving workflow continues without checking the authoritative source.
Dependent action chains
Closing a ticket, notifying a customer, or starting the next operation becomes unsafe when a prerequisite remains unproven.