---
title: "Agents Break Authorization's Core Assumption"
canonical: "https://current.tinyfish.ai/issue/13/foundations/article/8380/agents-break-authorizations-core-assumption"
publication: "TinyFish"
publisher: "TinyFish"
language: "en-US"
guide: "https://current.tinyfish.ai/llms.txt"
issue: 13
section: "foundations"
section_name: "Foundations"
published: 2026-01-22
word_count: 99
source_links: 0
---

# Agents Break Authorization's Core Assumption

*January 22, 2026*

[Read on the website](<https://current.tinyfish.ai/issue/13/foundations/article/8380/agents-break-authorizations-core-assumption>)

Four security vendors shipped agent identity solutions this month. CrowdStrike bought SGNL. Microsoft released Entra Agent ID. Qualys and Exabeam launched competing products. They're racing to solve the same problem.

Traditional authorization assumes users request resources directly. Agents break that model. When a marketing employee asks an agent to analyze customer data, the agent executes using its own permissions. The employee gets information they couldn't access directly. No misconfiguration. No policy violation. The authorization system just can't see the real requester.

Audit trails show agent activity, not who made the request. Permission boundaries dissolve when agents act as intermediaries.

## More

- [Foundations — Issue 13](<https://current.tinyfish.ai/issue/13/foundations/markdown>)
- [Issue 13](<https://current.tinyfish.ai/issue/13/markdown>)
- [Publication guide](<https://current.tinyfish.ai/llms.txt>)