I measured what an AI agent actually holds when it authenticates as me. Authentication turned out to be a token whose scope string literally says user_impersonation . Authorization came almost entirely from group membership that standard permission checks cannot see. Permission scoping differed by two orders of magnitude between two production stores reached an hour apart, and audit coverage ran inversely to what the credential could do. The environment where the agent could delete from a secure database was the only one with no audit trail. When I measured the machine identity our own...

Source: The New Stack