Every major identity and access management (IAM) system was designed for human users: a person logs in, authenticates, gets a role, performs actions. The system knows who did what.
Agents break this model. They act on behalf of users — but they're not the user. They use the user's credentials — but they're not the user. They may serve many users across sessions — while carrying one set of credentials throughout.
IAM systems weren't designed for an entity that acts, delegates, remembers, and operates continuously without being anyone in particular.
When an agent takes an action, who did it? The answer is genuinely unclear. Was it the user who prompted the agent? The developer who deployed it? The orchestrator that delegated the task? The sub-agent that executed it?
This gap in attribution is not a logging problem — it's a design problem. If you can't clearly attribute an action to a specific principal with specific authority, you can't enforce least privilege. You don't know what "minimum necessary access" even looks like.
Agents borrow identity (from their makers, their operators, their users) rather than owning one. That borrowed identity is the attack surface — it can be manipulated, over-delegated, retained too long, or handed to the wrong agent. All five vulnerability types in AG03 trace back to this.