Contos poses his question in the present tense, and that is the easier half of it [3]. Real-time visibility is a detection ambition, and detection ambitions can be deferred. Reconstruction after the fact is a documentation obligation, and obligations arrive with deadlines attached: an audit finding that needs a response, an incident timeline that counsel has to sign. That is why the agent identity gap shows up on the audit and response side of the house before it shows up as a breach.
The mechanism he describes is not exotic access abuse. An agent holding legitimate credentials performs actions that are technically authorized and operationally unintended [11]; one agent triggers a second, which touches a third system that widens access or starts a downstream workflow [12]. Contos argues most failures will come from ordinary agents doing exactly what they were allowed to do, just not what anyone expected [5]. The forensic consequence is precise: each hop is separately valid and separately logged, and the join between those hops exists nowhere in the record [13].
The board-deck version of the control story is a registry, an approval workflow and a policy framework that set boundaries before deployment [10]. That is worth having, and it answers exactly one question: was this permitted, at the moment permission was granted. What happened next is a different question, one the same record was never built to answer, because the permission predates the sequence it later governs. Contos adds that most organizations do not hold a complete inventory of the machine-to-machine delegation layered on top of enterprise identity [14], which means even the permission answer may rest on a partial register.
The provenance is worth stating plainly: this is a single Forbes Tech Council column by a security vendor's field CISO [1], carrying no incident counts and no dated cases [1]. Fair, and it should govern what the piece is used for: it is a problem statement, not a measurement. The load-bearing part does not depend on a number. Traditional identity models assume stable identities running known functions, with access reviewed and periodically audited [4], and role definitions and entitlement reviews were built for static conditions rather than dynamic ones [6]. Whether that assumption still describes your environment is checkable inside your own logs, without accepting anyone's threat narrative.
The tradeoff is velocity against reconstructability, and it is worth naming rather than implying. Contos describes development cycles compressed from weeks into days or hours [7], and a "turn it on and see what it does" posture that he attributes to velocity demands rather than to any security leader's preference [8]. Weeks saved at deployment are not free; some fraction of them is spent later rebuilding a sequence from fragments, at consultant rates, under someone else's clock.
Separating timescales keeps this honest. Cross-vendor agreement on how an agent's delegated identity and action chain are represented in a log is a decade of standards work, and nothing in this record suggests it is close. Whether you can produce a defensible sequence for the agents already wired into Salesforce, Workday, GitHub and Slack [9] is a question your own engineering can settle this quarter. Deferred work still needs doing later, at consultant rates, at the moment the narrative is demanded rather than requested.
