Almost every agent-identity product now ties an AI agent to a human, and most tie it to the wrong one. "The agent inherits the identity of its user" has become the default, yet it quietly collapses two different people into one: the principal whose authority the agent borrows for a given action, and the owner who is accountable for the agent existing at all.
The two carry opposite rules. When an agent acts for a principal, it must not exceed that user's rights, or it becomes a confused deputy that a single injected instruction can turn against them. Under an owner, the same agent can and often must hold access the owner personally lacks, exactly as a CFO is accountable for finance-team access she does not have herself. Confuse the two, and you get privilege escalation on one side and unaccountable autonomy on the other.
This session separates the two relationships cleanly and derives the rule that reconciles them. When an agent acts on someone's behalf, its effective authority is bounded by the intersection of its own entitlements and that user's, never the union. From there the talk asks a sharper question: what would it mean to govern an agent by what it is for, rather than by whose identity it wears? That same confusion extends to the tools: most platforms still bind agents to a human identity rather than to a task, and we will look honestly at what their "purpose" and "intent" features actually deliver.
