4 standards solve agent identity. None solves the harder question: Is it still the agent you approved?

I’ve stopped being surprised by the service account nobody can explain. It was created for a migration that finished years ago. It still holds credentials. Whoever requested it left before anyone wrote down why. And it passes every access review, because the review asks whether the account is valid. It is. That’s what I keep thinking about now...