Thirteen agents in, and the identity plane is still empty

This is the Identity Control Surface made concrete. AWS has published a reference architecture that governs non-human identity at the tool invocation layer, precisely where agentic risk concentrates. For enterprise teams scaling agent deployments, the pattern of identity-aware authorization per tool call sets the governance baseline. Organizations without an equivalent control plane are exposed at the exact point where agents reach into production systems. The architecture gives practitioners a vendor-backed blueprint to validate or close gaps in their own agent identity governance.

Workspace-level identity governance is the first layer of the Identity Control Surface, and OpenAI has now made it a native capability rather than a configuration afterthought. For enterprise AI buyers, this shifts the question from whether controls exist to whether they are correctly scoped and audited. Applied Identities clients should treat this release as a prompt to audit existing ChatGPT Work deployments for permission hygiene, particularly across Codex-enabled non-engineering teams where the blast radius of misconfigured access is highest.

The gap between scanner rankings and incident records is the operational signal here. Prompt injection is the primary Decision Surface attack vector, targeting the boundary where human intent translates to agent action. The fact that scanners cannot detect it confirms that standard security tooling offers no coverage at the point of highest exposure. Enterprise AI governance programs that rely on scanner output for LLM risk posture are measuring the wrong thing. Detection requires behavioral monitoring at the agent interface layer, a capability most organizations have not yet built.

Thirteen agents per organization is a governance inflection point. Each agent is a non-human identity with tool access, data permissions, and decision authority. At five agents, informal oversight is possible. At thirteen, the Identity Control Surface requires a systematic inventory or it will not hold. The 70% autonomous customer-service session rate in participating organizations also signals that the Compiled Corporation pattern is arriving in production at scale, compressing the timeline for clients still in POC. The current AAI Organization score of 68 reflects readiness that most enterprises have not yet matched.

When a travel company's non-engineering teams are shipping product through agentic code generation, the boundary between business strategy and software execution has collapsed. This is the Compiled Corporation in a sector where digital product velocity is competitive advantage. The governance implication is immediate: non-engineering teams operating agentic dev tools require the same identity and permission controls as engineering teams, including audit trails for what agents built, on whose authority, and with access to what systems. The Admin plugin signal above pairs directly with this deployment pattern.

This case is a Janus Brands failure at the adversarial extreme. A synthetic think tank with an AI-generated identity and publication record passed as a credible institution long enough to circulate policy-relevant content. For enterprise brand and communications teams, the signal is that AI-generated institutional identity is now a mature attack surface, one that competitors, adversaries, and bad actors can deploy against a firm's reputation or its clients' trust. Brand integrity programs that do not account for synthetic impersonation at the organizational level are operating with an incomplete threat model.