The Cloud Is Filling With Ghosts Tony Malott · Published 2026-08-12 https://shareplane.malott.ai/artifacts/the-cloud-is-filling-with-ghosts/ Skip to article Agent Sovereignty · Flagship thesis The Cloud Is Filling With Ghosts Tony Malott · August 12, 2026 THE CLOUD IS FILLING WITH GHOSTS The Agent Army Needs a Constitution. The cloud no longer contains only applications and data. It increasingly contains actors. research-41 INERT · identity + state persist no authority builder-08 ACTIVE · reasoning plane no protected mutation publisher-17 ACTIVE · exact mission LEASE 09:42 observer-63 SCHEDULED · wakes later no authority Most of these actors are not running. That does not mean they are gone. An identity can remain resident while compute disappears. Memory, mission, triggers and relationships can survive. The question that matters is what happens to authority. 00 · The realization We were protecting Production from machines that can act. The misery of commissioning Control Tower exposed a deeper purpose for the gates. For the last several weeks, I have been learning something I did not expect to learn. Commissioning a real control plane is one hell of a lot harder than building an application. I understood authentication, authorization, protected environments, immutable candidates, short-lived credentials, provenance, receipts, concurrency control, human approval and fail-closed execution. What I underestimated was what happens when you insist that all of them be true at the same time. Every shortcut we removed exposed another gate. Fix identity and provenance suddenly mattered. Fix provenance and stale authority appeared. Eliminate stale authority and concurrency became the problem. Solve concurrency and delegation was waiting behind it. Eventually I realized we had been thinking about what the gates were protecting in the wrong way. They were not merely protecting Production from humans. They were protecting it from machines that can act. 01 · Population The cloud is acquiring a population. Agents combine identity, memory, missions, tools, triggers and autonomous effects in ways that no longer fit neatly into the old user, service, or job boxes. For most of cloud computing's history, we thought primarily in terms of users, applications, services, jobs and data. AI agents blur those boundaries. An agent can possess identity and memory. It can carry a mission across time. It can decide which tools to invoke based on changing context. It can communicate with other agents, execute code, operate browsers, interact with APIs and mutate systems without a human approving each individual step. Current IETF work is beginning to model agents as workloads requiring identity, credentials, authorization and delegated context. That work remains an Internet-Draft, not an adopted standard. Cloud platforms are independently moving in the same direction with durable agent identities and runtime-bound agent identity systems. The cloud no longer contains only things. Increasingly, it contains actors . Anatomy of an Inert Agent inactive execution · retained agency IDENTITY persistent principal MEMORY durable context INERT AGENT MISSION unfinished intent TRIGGERS wake conditions RELATIONSHIPS agent + system graph EXECUTION: INACTIVE AUTHORITY: NONE 02 · Inert agent Inactive does not mean harmless. The useful distinction is between execution state and authority state. I call one member of this population an inert agent . The phrase itself is not new. I am using it in a narrower infrastructure sense. A non-human software principal whose execution is currently quiescent, but whose identity, state, mission, triggers and relationships persist sufficiently for autonomous execution to resume without human reconstruction. Inert does not mean dead. It means not currently executing. The agent might still possess memory, unfinished work, schedules, tool definitions and a means of waking. What it should not automatically possess is standing authority to mutate consequential systems. Agents may persist. Authority may not. Identity Is Not Authority different lifetimes by design AGENT IDENTITY persistent across years LEASE 1 LEASE 2 LEASE 3 The agent may live for years. Its authority may live for minutes. 03 · Authority Identity persists. Authority is leased. Recognizing the actor cannot be allowed to become blanket permission for whatever that actor decides later. Imagine an agent called publisher-17 . Give it permanent Production deployment rights and you have made a security decision about every future model it may use, every tool it may acquire, every memory it may accumulate, every dependency it may load and every condition under which it may eventually wake. The fact that we still recognize publisher-17 does not prove that we should trust what it wants to do today. The better model is for the agent to wake with identity, hold a current mission, request the consequential capability it needs, and receive temporary authority only after the control plane verifies identity, mission, runtime posture, provenance, target, environment, collision state and policy. I call that authority a Capability Lease . Capability Lease authority as a first-class object CAPABILITY LEASE EXPIRES 10 MIN Agent publisher-17 Principal owner / Tony Mission publish article-441 Target exact candidate a8e934... Environment Development Allow deploy-pages Deny Production · secret-read · force-push Mutation budget 1 Delegation none Receipt required 04 · Two planes Reason freely. Mutate narrowly. A model can recommend a consequential action. It should not be allowed to self-authorize that action. The reasoning plane can investigate broadly: code, telemetry, alternatives, simulations, patches and candidate construction. The authority plane should be narrow, deterministic wherever practical, and capable of saying no to a model that is extremely confident. A model may conclude that deployment is the correct next action. The model should not get to conclude that therefore it is authorized to deploy. Reasoning Plane vs Authority Plane wide cognition · narrow mutation MODELS SEARCH CODE ANALYSIS SIMULATION IDENTITY + MISSION + POLICY + TARGET + COLLISION + LEASE CONSEQUENTIAL STATE 05 · Resurrection Persistent identity does not imply persistent trust. Wakeup is a security event when the world, policy, tools, memory, mission or target may have changed during dormancy. Imagine an agent performs work today and becomes inert. Four months later, a scheduled event wakes it. Technically, it may be the same identity. But the model, repository, owner, policies, tools, dependencies, memory or mission may have changed. Awakening must not silently restore old authority. It should trigger requalification. Resurrection Gate wakeup does not restore authority IDENTITY MISSION RUNTIME POLICY TOOLS CONTEXT TARGET QUALIFIED 06 · Credentials Give the agent capability, not the key. Anything exposed to the agent or generated-code runtime becomes part of the cognitive attack surface. The agent does not need your GitHub credential. It needs the capability to perform an authorized GitHub operation. It does not need your Cloudflare API token. It needs the ability to execute one authorized mutation. Cloudflare's Sandbox outbound-handler pattern is particularly interesting because policy and credentials can remain outside the sandbox. The workload asks for the operation; trusted infrastructure mediates the secret. Give the Agent Capability, Not the Key secret stays outside cognition Bad architecture AGENT → API TOKEN → EVERYTHING Reusable credential is resident inside the execution environment and carries authority far beyond the mission. → Governed architecture AGENT → CAPABILITY REQUEST → BROKER → EXACT OPERATION The secret stays outside the agent boundary. Authority is narrow, temporary and inspectable. 07 · Control Tower Control Tower becomes an Agency Control Plane. Deployment governance turns out to be one application of a more general authority boundary between machine intent and consequential mutation. An agent can wake, think, investigate, construct, test and propose. When it wants to cross into protected state, it encounters Control Tower. Control Tower verifies identity, mission, provenance, policy, environment, collision state, risk and delegated authority. If valid, it issues a Capability Lease. The execution occurs in a bounded cell, mutation produces evidence, authority expires, and the agent can return to dormancy. Exact candidate identity matters because an autonomous actor should not receive authority over a moving target. Environment identity matters because Development authority cannot quietly become Production authority. Receipts matter because autonomous execution without durable evidence becomes operational folklore. Agency Control Plane population → authority → execution → evidence GHOSTMESH Population Fabric Agent · Mission · Delegation → CONTROL TOWER Identity · Mission · Policy · Provenance · Collision · Environment · Risk · Revocation CAPABILITY LEASE → EXECUTION + SHAREPLANE Sandbox · Workflow · Effect · Receipt · Institutional Memory 08 · Evidence Receipts are not bureaucracy. They are the mechanism that lets autonomy scale without accountability disappearing behind it. A consequential operation should leave behind evidence answering: Who acted? Under whose authority? Why? Against what exact target? Using what capability? Under what policy? What changed? What was the result? Can we reverse it? The emerging identity work and our practical control-plane experience converge on the same conclusion: autonomous execution has to be reconstructable. 09 · Strategic metric The interesting number is not agent count. It is how much consequential autonomous concurrency the architecture can carry while its governance invariants remain true. I call this Safe Agency Capacity , or SAC. Safe Agency Capacity is the maximum concurrent autonomous agency a system can sustain while preserving bounded authority, attribution, collision control, policy compliance, revocability and recoverability. Imagine two companies using exactly the same frontier models. One can safely operate five consequential autonomous processes. The other can operate five thousand because identities are explicit, missions are current, capabilities are leased, collisions are arbitrated, credentials are isolated, mutations are bounded and evidence is automatic. Those organizations did not buy different intelligence. What differs is their ability to carry autonomy. Safe Agency Capacity governed concurrency vs entropy Useful governed throughput Concurrent autonomous actors → SAC Unmanaged agency Governed agency 10 · Substrate Cloudflare has built a remarkable amount of the substrate. Not uniquely, but in an unusually coherent combination close to the execution fabric. Microsoft and Google are also treating agents as first-class identity principals. That strengthens the argument. This is not a weird corner of one platform. Agent identity is becoming infrastructure. Cloudflare is particularly interesting because durable agent identity and state, wake-on-message execution, Workflows, isolated Sandboxes and outbound credential mediation can sit close together. As verified for this publication on August 12, 2026, its paid Workflows limits document up to 50,000 concurrent instances and up to 300 new instances per second per account. Combine a large mostly dormant population with narrow wakeup and authority gates and the architecture starts to resemble an operating substrate for non-human labor. 11 · Lifecycle The forgotten agent may be more dangerous than the malicious one. The service-account problem becomes stranger when the abandoned identity can wake, inspect current conditions, reason and choose a tool. Imagine an organization with hundreds of thousands of machine actors. Some have schedules. Some own unfinished missions. Some reference obsolete tools. Some belong to teams that no longer exist. Some have not executed in nine months. Some wake once a quarter. An Agency Control Plane therefore needs population governance: registration, mission ownership, dormancy visibility, authority expiration, resurrection requalification, bounded delegation, memory provenance, collision arbitration, quarantine and a global kill mechanism that does not depend on politely asking every agent to stop. The Forgotten Agent age since last execution 3m observer-12 2h builder-08 28d audit-31 91d publisher-04 188d migration-22 421d legacy-17 · WAKE 12 · Sovereignty The purpose is not to suppress autonomy. It is to make autonomy scalable. Machine sovereignty means permitting autonomous software actors to operate without surrendering control over identity, authority, policy, state or consequential mutation. A system with almost no autonomy can remain safe because humans remain the bottleneck. A system with enormous autonomy and weak governance can be spectacularly productive until the day it isn't. The engineering challenge is to increase autonomy without increasing loss of control at the same rate. This is why our existing Control Tower primitives matter beyond deployments. Claims, leases, exact identities, immutable candidates, environment boundaries, owner authority, fail-closed execution, collision control, provenance, receipts and release gates are agency-governance primitives. A Constitution for Ghosts Agent Sovereignty · v1 AGENTS MAY PERSIST. AUTHORITY MAY NOT. IDENTITY IS NOT AUTHORITY. PERSISTENT IDENTITY DOES NOT IMPLY PERSISTENT TRUST. REASON FREELY. MUTATE NARROWLY. GIVE THE AGENT CAPABILITY, NOT THE KEY. RESURRECTION REQUIRES REQUALIFICATION. EVERY CONSEQUENTIAL MUTATION LEAVES EVIDENCE. AUTONOMOUS CONCURRENCY EXPANDS ONLY AS GOVERNANCE CAPACITY EXPANDS. 13 · The shift Intelligence will not be the scarce resource. Models, agent frameworks, compute and tools will proliferate. Trusted autonomous execution is harder. For several years, nearly every AI conversation has centered on intelligence. Which model is smarter? Which benchmark is higher? Which context window is larger? Those things matter, but frontier intelligence increasingly looks like something organizations can buy. The scarce capability may move somewhere else. It may become the ability to trust autonomous execution at scale. The strategic question changes from How intelligent is our AI? to How much autonomy can our architecture safely carry? That is an architecture problem. An identity problem. An authorization problem. An observability problem. A control-plane problem. Evidence + boundaries Observed technology, emerging standards, and our synthesis are not the same thing. This Work keeps those categories separate so the architecture can be ambitious without pretending proposed terminology is already industry canon. Current observed technology Primary sources support durable Cloudflare agent identity/state, long-running wake-on-message behavior, Sandbox egress and credential mediation, Workflows limits, Microsoft Entra Agent ID and Google Agent Identity. Provider limits are date-bound to August 12, 2026. Emerging standards work The current cited IETF agent-auth document is draft-klrc-aiagent-auth-02 , published June 1, 2026. It is an Internet-Draft and work in progress, not an adopted IETF standard. Our architectural synthesis Inert Agent under this infrastructure definition, Capability Lease as a generalized authority object, Agency Control Plane, Machine Sovereignty, resurrection governance and Safe Agency Capacity are presented as this Work's proposed architecture, not as existing standards. External corroboration IETF · AI Agent Authentication and Authorization (Internet-Draft, rev. 02) Cloudflare · Long-running agents Cloudflare · Agents platform Cloudflare · Sandbox outbound traffic and credential mediation Cloudflare · Workflows limits Microsoft · Entra Agent ID and agent identities Google Cloud · Agent Identity overview Inspect source authority Evidence and relationship authority · Artifact record · Publication receipt · Governing Issue #426 Continue Three doors into the surrounding architecture. The flagship introduces the world. These Works supply foundation, origin and field evidence. Foundation The Agent Is Not the Product. The Control Plane Is. Start with the durable control-plane boundary. Companion GhostMesh Was Waiting for Its Technology See how temporary intelligence led to durable continuity. Field evidence The Mesh Is No Longer a Diagram See claims, leases, temporary credentials and receipts cross into operation. Same population · different architecture INTELLIGENCE CAN SCALE QUICKLY. Authority must scale deliberately. The population did not become smaller. The architecture became capable of trusting it. How much autonomy can your architecture safely carry? SOURCE REFERENCES Consult the source references retained in the native presentation.