Start with what an inherited credential does to a log line. When an agent runs under the credential of the human it acts for, the log names the human [2]. Revocation couples the same way: cutting the agent's access means touching the person's, and reviewing the person's entitlements reviews both [2][3]. CrowdStrike's stated sequence is that the agent has to exist as a trusted identity before its access can be governed at all [17].
The product registers agents in a single directory with a cryptographically verifiable identity, enriches them with risk and privilege context, brokers short-lived access, and attributes actions end-to-end back to the human or workload [12][4][5][6][7]. Three of those start after discovery. Falcon Guardian has to find the agent and work out who owns it before the directory has anything to register [4]. Coverage is therefore the whole argument, and an agent someone stood up in a personal cloud account with a pasted API key is not governed by a control plane that never saw it.
The announcement does not name a protocol, standard, or credential format behind the cryptographically verifiable identity [13], and it puts no price or date on any of it [11]. The privileged access expansion is given by surface: SaaS applications, endpoints, code repositories and cloud infrastructure, with zero standing privileges as the goal and no mechanism attached [10][16].
Two products now split the question between them. Continuous Identity for AI Agents, announced earlier in the same year, decides what an agent may do against live identity, device, threat and business context, and revokes when conditions change [8]. Agentic IdP decides who the agent is [9]. Both arrived in 2026 [14], which is a fair measure of how new the second half of this model is, and the described outcome needs both halves running.
This is a design description rather than an exploit, and it carries no deadline. The gap is verifiable in logs an enterprise already keeps: where agent actions cannot be separated from the human accounts they borrowed, the accounting problem exists now, at whatever this eventually costs [2][11]. CrowdStrike's own description of agents delegating work to other agents at machine speed is the part that makes that reconciliation harder each quarter [15], and that is the reconciliation an operator still has to do by hand.
