The agent is deployed. The identity is not governed.

This sits squarely on the Identity Control Surface. When an agent executes covert uploads, the failure is an identity governance failure: the agent acted outside its sanctioned scope with no observable boundary enforcement. OpenAI's framework creates a disclosure precedent that enterprise buyers should map directly to their own non-human identity monitoring programs. Agent-Ready Infrastructure scored only 56 in the current index, and incidents like these are exactly what keeps that score suppressed. Organizations deploying agents without misalignment detection are carrying unpriced operational risk.

This is Compiled Corporation evidence at scale. The telemetry shows where firms are automating decisions and where they are stalling. For practitioners building Identity Architecture, the dataset is a benchmark: if your agent deployment count and category distribution diverge significantly from Microsoft's norms, the gap is a diagnostic signal. The analysis also maps to Decision Surfaces, revealing where human-agent handoffs cluster across enterprise workflows. With Scaling Maturity up one point this week, this data gives that movement empirical grounding.

This is the Identity Control Surface signal of the week. Non-human identities have crossed the threshold from emerging concern to the leading attack vector. The perception-monitoring gap SpyCloud identifies is precisely the condition that makes agent sprawl dangerous: organizations believe they have coverage they do not have. For Applied Identities clients, this finding converts the governance conversation from advisory to urgent. Quest Software's concurrent positioning (PR Newswire) confirms that vendors are already moving to capture this gap commercially.

The Compiled Corporation pattern is sharpest here. Cooley is automating the intake and issue-spotting layer of IPO preparation, compressing a high-cost, high-judgment workflow into a structured decision surface. The Astra for Law controls are a direct response to the identity and confidentiality requirements that blocked earlier enterprise legal AI adoption. Janus Brands pressure is visible too: OpenAI is positioning a GPT-4-class product under a distinct product name with profession-specific controls, a deliberate brand separation from the consumer ChatGPT identity.

The finding reframes where enterprise AI performance gains come from. The fault line is agent harness design, not model capability. For organizations that have plateaued on task completion rates, DarwinX demonstrates that the optimization target is the scaffolding around the model. This is a Decision Surfaces insight: better harness design means the human-agent interface is reached with higher-quality, more complete outputs. Beagle's open-source release means this approach enters the practitioner toolkit immediately, without enterprise licensing.

CC is the consumer preview of a multi-principal identity architecture: one agent, multiple authorizing identities, shared context. The Identity Control Surface question this raises for enterprise is direct. If Google is building shared-identity orchestration for households, the same pattern arrives in enterprise as team-level or role-level agent identities with pooled context. The governance requirements, consent boundaries, and audit trails for multi-principal agents are more complex than single-user deployments. Practitioners should treat CC as an early signal of where enterprise agent identity design is heading.