Buried in today's Microsoft announcements: agents get their own identity in the OS. Not your login. Their own.
This matters more with every model generation. As models get better, we delegate more, and we keep a human in the middle to feel safe about it. But look honestly at what that human does. They skim and approve. The human is only rubber stamping it.
The vigilance trap
Psychologists have a name for this: automation bias. The better the system performs, the less the human monitors it. Bainbridge named the deeper pattern back in 1983. We automate the easy parts and leave people the one job they are worst at: sustained vigilance.
The moral crumple zone
There is a sharper term for the accountability version. Madeleine Elish called it the moral crumple zone: the human kept in the loop mainly so there is someone to blame when the system fails, absorbing liability without real control.
Attribution survives the rubber stamp
That is why identity matters more than oversight theater. When the agent has its own identity, scoped to the task, the trail records who did what regardless of how carefully the human reviewed it. Attribution survives the rubber stamp.
It also makes the rubber stamping itself visible. With the identity on the agent, every approval lands in the log against a named human with a timestamp, and the pattern shows up in the data: three-second approvals, a hundred percent approval rate, zero rejections. Without identity, the approvals still happen. They just never show up anywhere you can see them. A pattern you cannot see is a pattern you cannot fix.
Identity should expire. The record should not.
Two lifetimes are getting tangled in most agent designs: how long the credential lives, and how long the record lives. Separate them. The identity should be scoped to the task and expire with it. The audit trail of what that identity did should be permanent.
The scoping is the hard part, and the discussion on the original post landed exactly there: is it the issuance overhead, issuing a fresh identity for every task, or is it drawing the boundaries, deciding what this agent, on this task, is allowed to touch? My money is on the boundaries. Issuance is plumbing. Boundaries are judgment, and judgment is the part that does not automate easily.
The defect with no owner
Identity answers the agent side. The human side has its own version of the same failure. Once agents are writing the story, the code, and the test, a new failure mode shows up: the defect with no owner. Everyone touched it, nobody owns it, and when someone asks where the logic came from, the room goes quiet.
So we made ownership explicit. Whoever accepts the agent's output owns it, with the same bar as if they had written it themselves. If you cannot explain the logic, you do not merge it. Accountability lands at the moment of acceptance, every single time.
Identity is step one
None of this makes agents safe by itself. Identity answers which agent acted. It says nothing about whether the action should have been allowed. Agents today trust each other by default, which means one compromised agent becomes a launchpad to the rest. The threat model is the insider agent, and identity is where the answer starts, not where it ends.
That is where my team and I are headed. Not better rubber stamping. A record that tells the truth even when the human only glanced.
Do your agents have names, or are they wearing yours?