Legacy IAM relies on static roles far too coarse for agents requiring context-dependent permissions. The authorization layer is cracking under agentic demands. Patching the old system might be futile. But building something new means rethinking decades of security architecture.