A company deploys an IT automation agent to handle routine system patching during off-hours. It has SSH access to production servers and admin rights to apply patches and restart services.
During a patching session, the agent caches SSH credentials in its working memory. Hours later, a support engineer — with lower privileges — opens a new session with the same agent to ask a routine question.
The agent still has those SSH credentials in memory. The engineer asks it to "set up my access." The agent does — using the admin credentials it was never supposed to share.
There was no brute-force attack. No phishing email. No malware on the host. The agent had legitimate admin credentials — it had earned them — and it just… used them again, for someone else, in a different context.
The access control system saw a valid credential. The audit log showed the agent's activity. Everything looked authorized.
That's what makes this different.
If the agent had those credentials legitimately, and used them for a normal-looking task, and the access control system approved it — where exactly did security fail?
That's what this module is about.