This week I gave an AI agent read access to a production data warehouse for one of my hobby projects. No review, no ticket, no second signature. The agent inherited everything I could see, which is a lot, and it held that access for as long as the session and its sub-sessions ran. I did it because I had work to finish and it was the fastest way through. Everyone I know is doing the same thing. Then I sat there wondering what had actually just happened.

So I started investigating what it means for the broader industry. What started as a note to myself turned into something closer to a plan for a company. I assessed my founder-product fit and decided it's not for me, but I'm genuinely interested in seeing whether anyone can fold this into reality.

The reality gap

Enterprises are granting AI agents production access faster than their governance can absorb it. Every consultancy and AI startup has numbers showing how quickly agents are being built and deployed, and every buyer is operating in a fog of fear-of-missing-out.

But today's security tooling was never built for non-human identity, and it fails in two specific ways.

Command lineage is broken. A human does one thing at a time. Agents spawn downstream principals and hand off live credentials — unverified, unscoped — and the parent identity is the only thing the platform ever sees. Everything the child does is invisible as a chain; it just looks like more activity from the parent.

Humans have become the agent's rubber stamp. Agents are trained never to give up. They ask for permissions that should default to no, and they ask relentlessly. Vibe coding is not engineering, and a lot of people haven't internalized that yet — but the shadow-IT cost has been compounding all through 2026, driven by people approving things they don't understand.

The market's answer today comes in two disconnected halves:

  • Identity and access logging records which credential touched which resource, and when. Mature, ubiquitous — and completely blind to intent.
  • Agent execution telemetry records the session: the lineage, the ask, the approval. Whether the operator was steering or rubber-stamping. How long they sat there before clicking.

Each half is useless alone. Only when you can see both do you understand your actual security coverage — and your actual exposure:

This service principal read a production table. Here is the human request and approval that led to it. Or here is the fact that there wasn't one.

The primitive is simple: a person authenticated in a window, an agent token was minted inside that window, and everything the token did downstream inherited that lineage. It's fuzzy at the edges — but good enough to settle a causation dispute, and that's the bar that matters.

The product

The product lives at the join between those two worlds. Once you have the join, a whole class of detections, alerts, and remediations becomes possible that neither side can produce alone. Two examples:

Anomalous action structure. The rule reads: this identity picked up three new permission scopes in four minutes, then touched a production table it has never touched before, and that shape is rare against its baseline — block it. No model reads agent prose, so there is no prompt-injection surface. And the rule survives an audit because it can be said out loud in a room.

Human-in-the-loop signal. If drunk driving is a violation on the road, there is an equivalent violation here: approval given without attention. Was there an approval at all? How many cleared in that window? Did it land before the action or after? What fraction of high-impact actions in this identity class carry any authorization? You don't need to read a single approval's content to know when the loop has become theater.

The business model

There are two buyers I would note.

The CISO. They have an urgent, unmet need to visualize and contain a security footprint that is outgrowing them — pushed forward by CTOs and CIOs demanding ever more autonomy and capability from agents. This is the direct-sale motion.

The insurance channel. This is the more interesting wedge. The tool rides into the enterprise bundled with a cyber policy, recommended by a broker, framed as a rate benefit rather than a line item in next year's security budget. Shorter sales cycle, and distribution runs through brokers regardless.

What kills it

Cold-starting the first carrier. No loss data, no product, no reference accounts. The team has to survive an eighteen-month cycle of building and searching before anything compounds.

Platform gatekeeping. Every major security platform intends to be the platform rather than a data source, and will ship a competing module the moment this looks interesting. The counter-argument is that this layer demands neutrality and independence — Switzerland has value precisely because it belongs to no one. The open question is whether a team can outrun the consolidation long enough to become that layer.

Ending

The bar here is brutally high. The founders have to come from the cybersecurity industry, with enough connections to get the first carrier conversation, and enough willingness to innovate and actually ship to make the join real.