The Breach You Can't Patch Meets the Agents You Already Deployed

This finding reframes the Identity Control Surface calculus. Enterprises treating LLM security as a configuration problem — tunable via guardrails and prompt engineering — are operating on a false premise. The flaw is irreducible, meaning agent governance must be designed for breach containment, not breach prevention. Any non-human identity with delegated authority over sensitive workflows is now a permanent, non-closeable attack surface. This compounds directly with the SailPoint finding that 82% of teams run agents but only 44% enforce dedicated policies. The practical mandate is least-privilege entitlement scoping and runtime behavior monitoring — not perimeter hardening alone.

This is the clearest quantitative read on the Identity Control Surface gap in the market. The majority of enterprises have crossed the agent deployment threshold without crossing the agent governance threshold. The 23% credential-leak rate from prompt injection is a direct consequence: agents operating under legacy identity models — long-lived credentials, over-privileged service accounts — are being exploited through the inference layer, not the network layer. Applied Identities work starts here: the gap between deployment velocity and policy enforcement is precisely the engagement surface for identity architecture practice.

The Compiled Corporation creates its own attack surface. As enterprises use coding agents to accelerate infrastructure provisioning and DevOps automation, those agents are systematically replicating the worst identity hygiene patterns from human-authored code — at scale and speed. This is a Decision Surface failure: the agent is making entitlement decisions without the contextual authority to do so correctly. The result is an identity debt load that grows faster than any manual remediation team can address. Governance tooling must intercept at the code generation layer, not after deployment.

The Compiled Corporation narrative is shifting from capability to economics. Efficiency-per-dollar is the metric that moves agentic AI from experimental budget lines to core operational infrastructure. When frontier intelligence and frontier efficiency converge in the same model, the CFO objection to autonomous workflow deployment weakens structurally. For enterprise AI readiness, this means the cost-based deferral argument is expiring — the question is no longer whether agentic automation is affordable but whether the identity and governance infrastructure to support it is in place. The AAI Product dimension at 60 reflects exactly this gap: capability is outpacing readiness.

Agent-Ready Infrastructure is the lowest-scoring top mover in the current AAI index (52, Brand dimension). Google's production hooks signal that the hyperscaler layer is hardening the plumbing — managed agents with explicit production lifecycle controls reduce the barrier to enterprise-grade deployment. For the Decision Surface framework, managed agent infrastructure shifts the human/agent interface upstream: developers configure agent behavior at the API layer rather than monitoring execution at the task layer. Enterprises evaluating multi-cloud agent strategies now have a mature Google-native option competing directly with Microsoft's Agent Framework GA.

This is the Janus Brand problem operationalized at the infrastructure layer. Enterprises that commit fully to Microsoft's agentic ecosystem gain integration density but surrender orchestration sovereignty — their agent identity, data access, and workflow logic become legible to and dependent on a single vendor. The independent orchestration path preserves Identity Control Surface ownership but requires organizational capability that most enterprises at AAI Organization score 66 do not yet have. The choice point is not technical — it is a governance and identity architecture decision that determines who controls non-human identity policy for the next five years.