Your Junior Engineer Won't Delete Prod. Your Agent Might.

Before AI, every security conversation was about entitlements. Every week another startup raised $20M to fix them. Then everyone pivoted to agentic security. Not because anyone solved entitlements. Because the model broke, and agents made the break impossible to ignore.

When you could count your servers

Infrastructure used to stand still. A company ran a few databases and a few servers, ones you could count on your fingers. One ops person managed access by hand and it worked.

Then cloud happened. Servers stopped standing still. We traded a few big machines for many small ones, spun up and torn down by automation. Ephemeral infra killed manual management.

Microservices multiplied it. Besides many small servers, we now had many small apps. Then SaaS piled on: dozens of tools outside your walls, each with its own permission model and its own admin panel.

The side effect: deciding which identities, human or machine, get to touch which tiny resource became a discipline of its own.

Enter entitlements management

The pitch made sense. One central interface. Every resource listed, every access decision in one place. Nobody wants a team clicking through 40 admin panels to configure who accesses what.

It looks promising until you try to adopt it. What happens next explains why nobody talks about entitlements anymore.

The still list problem

The entitlement model depends on an assumption from the old world: a still list of resources. That list isn't still anymore. It exploded, and it changes every day.

So orgs that govern entitlements land in one of two states. Either they hand out generic resource groups with too much permission, or they lock everything down and run a slow ticket queue for every one-off grant. Overprovisioned or paralyzed. Pick one.

Do the math on least privilege. A 100-person org runs 30 databases. Each database needs around 30 grants, each grant around 10 lines of policy. That's 9,000 lines someone has to write, review, and keep current while teams reorganize and databases come and go.

Nobody writes 9,000 lines. Teams write 100, ship the generic group, and move on.

Then agents showed up

Overprovisioning a junior engineer is a risk on paper, not in practice. That person wants to keep their job. They won't do spectacular harm with privileges they never asked for. The real cost is an occasional outage and a few flags on the next audit.

Agents flip that math. Your devs now run 10 agents each, so the policy count should 10x too. It won't, for the same reason nobody wrote the first 9,000 lines.

And here's the worst part. Agent overprivilege isn't an occasional problem. Agents hunt for creative ways to make humans happy. Fail at a task a few times, and deleting the database to start fresh looks like a great idea.

So you end up holding a massive liability, governed by a model that already failed the easier version of the problem. Same broken system. Catastrophic blast radius.

Where do we go from here

In my next post I'll discuss sandboxes. Spoiler: we're trying to use VPN under fancy names to control agents. And network-based security became obsolete around 2008.