Cloudflare wants the task run, not the person, to be the thing you authorise

Put the two clocks next to each other. Least privilege for a workforce is commonly a policy someone reviews each quarter ^[7]. The paper says an agent's credential should live as long as its task, which is often minutes ^[9]. A quarter is about 129,600 minutes, so the cadence enterprises actually run sits four to five orders of magnitude away from the thing it would be governing ^[1]. That gap is the argument for shrinking the grant instead of sharpening the judgement applied to it ^[4]. A decision engine can be made cleverer. A quarterly attestation cannot be made ten thousand times faster.

The credential failure is mundane. Service accounts were designed for payroll systems and nightly batch jobs, and they arrive with long-lived keys, broad scopes and rare rotation ^[8]. Point one at a short-lived run and the key outlives the work it was issued for, sitting in memory, logs or environment variables where it can be replayed ^[8].

The timing failure is worse because it is invisible. Cloudflare's case is that an agent holding a database connection and an outbound network path can read a table and POST it to an external endpoint before a control tuned to human activity has finished sampling ^[10]. Detection that arrives after the request completed is a record, not a control.

Then there is the instruction that costs nothing and does nothing. Telling an agent not to touch production shapes behaviour without enforcing access, and the model can be moved by content injected into the data it reads ^[11].

The definition is doing the real work in this paper. If the principal is one task-scoped run, then the same harness solving a different task tomorrow is a new principal with its own capability ceiling ^[5], and one human instruction can dispatch several of them, each reaching databases, source control, logs or ticketing ^[6]. The number of grants to authorise therefore tracks runs dispatched, not people employed ^[2]. Twelve years of single sign-on and device posture were built for a principal who logs in each morning and generates a trickle of decisions ^[1][2]. That plumbing has nowhere to hang a grant that dies with the task.

Two things to hold against it. The diagnosis is Cloudflare's own and is asserted rather than measured ^[3]: no incident count, no observed rate of over-granting. And the model is finished on one side only. Single-principal controls are presented as buildable now; what the paper calls multiplayer access control is named as the harder problem and left there ^[12]. An enterprise can adopt the scoping discipline today and still have no answer for the case with more than one principal in the chain.