Visibility was the first battle. We built dashboards, access reviews, and certification workflows. We learned to see our identity landscape. But seeing isn't knowing. Knowing means understanding what identities are actually doing inside your applications — not what policies say should happen, but what executes. In the agentic era, that distinction is no longer academic. Agents act at machine speed, on stale permissions, with no owner and no trace. Visibility can't catch that. Observability can. This session explores the frontier between seeing and knowing and why closing it is identity security's next imperative.