AI Agents Are Not Users: Building an Identity Model That Reflects That
The PocketOS incident, where a Cursor agent issued a single GraphQL mutation to wipe a production database in nine seconds, exposes the architectural failure of treating agents as human users or service accounts. Legacy identity models (OAuth delegation, static service accounts) create over-permissioning and large blast radii, lacking the behavioral context to distinguish routine tasks from destructive actions. The proposed solution is a first-class agent identity model that evaluates authorization at runtime against the specific request, rather than baking broad scopes into credentials at provisioning time.