Integration was the checkpoint

The integration layer is the best thing to happen to agent projects, and the enthusiasm is earned. Integration used to be the project. Every system an agent touched needed bespoke glue, rewritten whenever anything upstream moved, and most of the budget went there. The plumbing that finally got standardised collapsed that cost to something near configuration — which is why agents moved from demo to deployment inside a single year.

We would not want it back. But the same collapse removed something the organisation was getting for free, and the clearest place to see it is AI agent identity: the question of what any given agent can actually reach. Ask a competent security team which of their people can open the payroll system and you get an answer in minutes. Ask the same question about the agents and you get a pause, then the names of a few people who might know.

The cost was the conversation

An integration used to be a project, and a project had reviewers. It was scoped, security-reviewed, architecture-reviewed, budgeted and written down. Nobody enjoyed the process and plenty of it was theatre. But its real function was never technical. The expense of building a connection forced a conversation about whether the connection should exist at all — and that conversation was the only checkpoint the organisation had on reach. It was funded entirely by friction. When the friction went to nearly zero, the checkpoint went with it, and nothing replaced it, because almost nobody had noticed it was there.

Ten reasonable yeses

The trouble is not any single connector. Each one is small, specific and individually defensible: the agent needs the ticket system to do the thing it was built to do, the document store to answer the question it was built to answer. Anyone reviewing that request in isolation should approve it. The aggregate is a different object entirely. Ten reasonable connections give one agent a composite view of the business — and a composite capability — that no individual approval contemplated and that no single employee holds. Nobody approved the union. The union was never on an agenda.

Nor is anyone behaving badly. Connectors get added by the person building the agent, at the moment they need one, to make something work today. That is the same dynamic behind shadow AI: the sanctioned path is slower than the work, so the work routes around it. And because each addition is a configuration change rather than a project, it produces no artefact — no ticket, no diagram, no budget line anyone will read next quarter. The reach grows and leaves no record of growing. This is delegation arriving through the side door: decision authority transferred one connector at a time, by people solving a Tuesday problem rather than setting a policy.

AI agent identity has no register

Organisations know their employees. Decades of joiner-mover-leaver discipline mean a person who arrives gets provisioned, a person who moves gets re-provisioned, and a person who leaves gets cut off — imperfectly, but the machinery exists and someone owns it. Almost no organisation can produce the equivalent list for its agents. There is no register of non-human identity, no periodic review, no expiry, and nothing that revokes. An agent built for a project that ended two quarters ago usually still holds every connection it was ever given, and will hold them until somebody deletes it, which nobody has a reason to do, because it costs nothing and sets off no alarms. Access for people decays by design. Access for agents accumulates by default.

Two harmless halves

The sharpest version of the exposure is not volume, it is combination. Enterprises have spent years deliberately keeping certain capabilities apart: the system that identifies a customer sits away from the system that records what they did, the directory sits away from the compensation data, the operational log sits away from the thing that would make the log personal. Neither half is sensitive alone. That separation is rarely an accident of architecture — it is usually the control itself. An agent with connectors to both now holds the join, and the join is precisely what the control existed to prevent.

We have argued that the value in enterprise data sits in the combination rather than in any single source. Sensitivity works the same way, for the same reason. If combining your data is what makes it valuable, combining your data is also what makes it dangerous, and an integration layer that makes combination trivial has made both trivial at once. No connector review sees this, because no connector review looks at the other connectors.

Review the union, not the increment

What we would tell a client here is unglamorous and mostly clerical. Keep a register of agent identities and what each one can reach — the list you can already produce for people, for the population you currently cannot. Then review the union rather than the increments: the question worth asking is not whether this connection is reasonable, but whether the total reach of this agent is reach you would grant a person, and if not, why the answer changes when the holder isn't one. Give every connection an expiry by default, because the failure mode is accumulation and nothing else removes it — a connection that still matters is renewed in a moment, and one that doesn't will quietly disappear, which is the entire point. And provision per task rather than per agent wherever the work allows, so the reach exists while the job does and not for the two years afterwards.

None of that requires slowing the building down, which is the objection we expect and think is mostly wrong. It requires that somebody hold the picture nobody currently holds.

Standardised connection did not create new access. It removed the last place anyone had to justify it. That is the trade, and it is worth naming precisely: you bought a real collapse in cost, and you paid for it with a conversation you didn't know you were having — the one the expense used to force, about whether an agent should be able to reach a thing at all. The friction you removed was doing a job you never assigned it and never priced. That job is yours now, and nothing in the tooling will remind you it exists.