What Happened
Token Security published a census of the AI agents actually running inside enterprise environments, and the shape of the problem is not the one most security programs are defending against. The dominant class of agent is not a governed, service-account-backed bot sitting behind an API gateway. It is a local harness— a coding agent like Claude Code or Cursor running on a developer's laptop, executing shell commands and calling MCP tools as the employee, with the employee's credentials, tokens, VPN session, and network position.
By Token Security's count, 68.6% of discovered agents fall into this category. And they are largely invisible: 82% of surveyed organizations discovered at least one AI agent that nobody in security, IT, or governance had signed off on — a shadow workforce of automated actors inheriting human access, one npm install at a time.
The Agent Isn't Impersonating the Human. It Is the Human.
This is the part that breaks the standard IAM playbook. When Claude Code runs a command, it is not spoofing an identity or replaying a stolen token. It is using the developer's real, validsession. Every request it makes is, cryptographically and from the server's point of view, indistinguishable from the human sitting at the keyboard — because it is literally the same credential.
That collapses the one distinction every access-control system depends on: the separation between who is authenticated and who is acting. Your MFA fired — for the human, hours ago. Your device posture is fine — it is the developer's trusted laptop. Your short-lived token is valid — it was minted for a person. None of it can answer the only question that matters for an agentic workload: is a human actually authorizing this specific action, right now, or is an autonomous process iterating through the access a human happens to have?
Logs Tell You What Happened. They Can't Tell You Who Authorized It.
Anthropic's Compliance API is a genuine step — it surfaces agent activity that was previously opaque. But an activity log is a record, not a control. It can tell you that an agent read a repository, called a tool, or touched a database. It cannot tell you whether that access was legitimate, because the log inherits the exact same ambiguity as the credential: it shows the employee's identity acting, with no way to distinguish the human's deliberate authorization from the agent's autonomous initiative.
You end up with perfect forensics of an unanswerable question. When the incident review asks “who authorized the agent to exfiltrate that table at 2 a.m.?”, the log says: the developer's account did. The developer says: I was asleep. Both are true. That gap — between what the log records and what a human actually authorized — is the governance layer the entire industry is missing for agentic work.
Power of Agent: Bind the Agent to a Human, Sign Every Action
BioAuth's Power of Agent (PoA) is built for exactly this failure mode. PoA is designed to give supported agent actions scoped, revocable authority tied to human approval, with signed receipts that an application can validate and enforce according to its own policy.
For a supported action, a signed receipt can record the agent, approving authority, scope, action, outcome, and time so the receiving application can verify the authorization context. If required evidence is absent or invalid, the application can deny the action rather than relying on a post-mortem log.
That also gives customers a control for shadow agents. When an application is configured to require a supported authorization record, an unapproved agent cannot satisfy that requirement and the application can reject it.
The Takeaway for the Enterprise
The agentic-AI wave did not create a new authentication problem — it exposed the one that was always latent: our systems authenticate identities, but they authorize credentials, and they have no way to bind a credential's use to a live, accountable human. As long as that hole is open, every coding agent on every laptop is a governance blind spot with production access.
Activity logs describe the past. Power of Agent governs the present. Require scoped human-approved authority and signed receipts for supported agent actions, and the question “who authorized this?” becomes something the receiving application can evaluate instead of infer from an account activity log.