The story
Every identity in a well-run directory has an owner, a named human who answers for it. When someone joins a company, there's a form, a manager, a start date and a background check. When an AI agent gets spun up, often there's nothing. It gets an API key with a scope wider than the CFO's, it reads the whole mailbox, and when you ask the room who owns it, everybody looks at the floor. The owner field is blank.
That's what worries me about where this is heading. Non-human identities already outnumber people in most organisations, and now they can reason and act on your behalf. So who delegated that authority? If the agent signs something, is that your signature?
I run a lot of agents myself, so I'm not scared of the machines. I'm scared of the gap where a person should be. Mine each get their own lane: a separate user, redacted secrets, least privilege, just-in-time access that expires, every tool call logged, and a kill switch I actually own. Being sovereign doesn't only mean being in control. It means being accountable. Fill the field.
Key lines
- “Joiner with no leaver date — that's a thing that'll stay”
- “Every agent needs a human name on the line / If it moves on your behalf, then the blame's on your side!”
- “If the agent signs the contract, is the signature you?”
- “It's not the machine I don't trust. It's the gap where a person should be.”
Written by Nicholas Martin. Produced with Suno v6.