Identity-first
Every agent is someone your directory knows
Each agent gets a real identity in your identity provider — its own login, its own scoped roles, its own credentials in the vault. Access is granted like you'd grant it to a hire, revoked the same way, and every action is attributable to exactly one principal.
● our org chart is agents with KC identities