Somewhere in your organization, an agent is running. It was built on a platform your security team doesn't own, authenticated with a token someone provisioned six months ago, and it's been delegating to other agents in ways nobody mapped out. This is not a hypothetical.

Agentic AI has outrun the frameworks meant to govern it. First-party platforms, third-party SaaS, low-code builders, shadow deployments...agents are going up everywhere, and the identity and access controls designed for humans aren't keeping pace. The result is a distributed build problem that has quietly lapped every identity and security framework trying to contain it.  A vendor and two practitioners who have lived inside these problems sit down, in a spirited discussion, to work through what securing agentic builds and traffic at scale actually requires, not with theory, but in the architecture and frameworks being stress tested right now. The conversation draws on an emerging agentic trust framework and standards, who can forget this as it is so important, to ground the discussion in something more durable than vibes and vendor promises.

Leave knowing exactly who or what authorized the agent, what it's allowed to do and why, and why "trust me bro" is not a valid OAuth scope.