Security today stops at sign-in-once agents start acting on a user's behalf, permissions and identity need to travel with every tool call, retrieval, and decision the agent makes.
Every agent is designed and reviewed before it's built-roles, interactions. and guardrails signed off at a formal governance checkpoint, not discovered in production.