When Agent Identity Is Not Enough Tony Malott · Published 2026-08-27 https://shareplane.malott.ai/artifacts/when-agent-identity-is-not-enough/ When Agent Identity Is Not Enough By Tony Malott · Published August 27, 2026 Microsoft is industrializing identity, security, tool governance, observability, and runtime controls for enterprise agents. GhostMesh has been attacking a different layer: whether a specific piece of consequential work remains legitimate against the current state of the world. The architectures increasingly look complementary. 1. Microsoft Just Validated the Problem Agent 365 came up recently in a technical discussion about controlling enterprise AI agents. I had not followed the product closely, so I went looking. The deeper I got, the more familiar the problem became. Microsoft now explicitly positions Agent 365 as the control plane for enterprise agents : a centralized layer for observing, governing, and securing agents across an organization. It is generally available, provides a unified registry, and ties agent governance into Microsoft Entra, Purview, Defender, and the Microsoft 365 administration plane. 1 2 Microsoft is also making agent identity a first-class enterprise primitive. Entra Agent ID extends enterprise authentication, authorization, lifecycle governance, ownership, sponsorship, access protection, and audit concepts to non-human AI actors. 3 That is serious infrastructure. It is also remarkably familiar. For more than a year I have been developing an architecture called GhostMesh around a related problem: how increasingly capable AI systems can perform consequential, long-running work without losing human authority, operating from stale state, colliding with other executors, or declaring success before the surrounding systems have actually reached the intended outcome. The canonical public architecture is documented at GhostMesh.ai . Its Semantic OS, sovereignty model, and closed-loop execution doctrine define the architecture; SharePlane is the working reference implementation , not an architectural dependency. 10 11 12 13 The overlap is not evidence that Microsoft copied GhostMesh. Nor would it be credible to pretend an independently developed architecture is commercially equivalent to Microsoft's global identity, security, compliance, and management platforms. Once AI begins acting rather than merely answering, control becomes infrastructure. That is the useful observation. Microsoft independently arrived at the same underlying premise. For much of the current AI cycle, the industry focused on intelligence: can the model understand, reason, plan, use tools, coordinate with other agents, and operate for longer periods? Each improvement expands what machines can accomplish. It also expands what machines can affect. Once an agent can modify code, update enterprise records, communicate externally, alter infrastructure, invoke tools, access sensitive information, or coordinate other agents, model capability stops being the only important architectural question. Another question appears: under whose authority is all of this happening? Agent 365 is Microsoft's increasingly comprehensive answer at the enterprise-governance layer. But controlling the agent is not necessarily the same thing as controlling the work. The opening distinction: enterprise governance and runtime controls are necessary, but a legitimate actor can still attempt an illegitimate state transition. 2. Four Control Planes The easiest way to understand the relationship is to stop treating “agent control” as one problem. It is several. 1. Enterprise Governance Who is the agent? Who owns it? How does it authenticate? What may it generally access? Which security, compliance, lifecycle, data, and tool policies apply? Microsoft strength: Agent 365, Entra, Purview, Defender 2. Runtime & Orchestration How does the work execute? How are tools invoked? How is workflow state preserved? Where can policy interrupt execution? How are humans brought in? Microsoft strength: Agent Framework, Agent Hooks 3. Execution Authority Is this exact action legitimate now? Which task, scope, state, temporary ownership, expiry, supersession, and human boundary govern this execution? GhostMesh focus 4. Evidence & Convergence Did the intended state actually result? Can the system prove what happened, validate the resulting state, reconcile providers, and determine terminal convergence? GhostMesh + enterprise observability The layers overlap, but they should not silently redefine one another. Entra should remain authoritative for enterprise identity. Agent 365 should remain authoritative for broad enterprise agent governance. A runtime should own actual runtime state. The underlying provider should remain authoritative for the resources it owns. GhostMesh can then own something narrower: the legitimacy and convergence of consequential work across those systems. 3. The Five Green Lights Problem Suppose an enterprise agent is preparing to modify Production. Every conventional governance check is green: ✓ Identity ✓ Authentication ✓ Resource access ✓ Approved tool ✓ Security posture Should the operation proceed? Not necessarily. Perhaps Production was paused five minutes ago. Another executor may have acquired ownership of the deployment lane. The target state may have changed since the agent reasoned about it. The task may have been superseded. The approval may have expired. A legitimate actor can still perform an illegitimate state transition. This is the Five Green Lights Problem. Identity can remain valid while the current work loses legitimacy. A permission says, “You are generally eligible to perform this class of action.” Execution authority says, “You are currently authorized to perform this particular action for this particular piece of work.” Those controls operate at different timescales. This is also why revoking an entire identity or disabling a tool is often the wrong response. If one assignment becomes obsolete while the agent remains valid for other work, the system needs a narrower control primitive than account revocation. 4. State-Transition Governance The Five Green Lights Problem leads to a more precise formulation. Traditional authorization asks about actor, resource, action, and policy. Consequential agent execution adds task, current authority, expected state, temporary ownership, time, concurrency, supersession, and human boundaries. The question changes from: May Agent A write to Repository X? to: May Agent A perform this specific transition against Repository X, from its current state, for this assignment, under the authority that exists right now? That is state-transition governance . An advanced agent is not merely a strange new kind of enterprise user. It is also a state-transition engine. Identity management gives us roles, credentials, permissions, and access policies. Distributed-systems engineering gives us preconditions, leases, fencing, compare-and-swap, idempotency, versioning, and reconciliation. Serious agent control increasingly needs both. The execution passport A useful GhostMesh abstraction is an execution passport: a short-lived, machine-readable description of bounded delegated work. It can bind an enterprise actor to a task, resource scope, expected state, permitted and prohibited operations, temporary claim, expiry, human boundaries, and required evidence. The passport does not replace Entra or enterprise IAM. It assumes standing enterprise authorization already exists. Both controls must succeed. ENTERPRISE ACCESS   +   CURRENT EXECUTION AUTHORITY   =   OPERATION MAY PROCEED Continuous execution authorization Authorization becomes temporal. “Authorized at 14:00” does not imply “authorized at 14:30,” even if the identity, credential, enterprise permission, and tool remain unchanged. This does not mean asking a human before every tool call. Machine-readable authority should be refreshed at meaningful mutation boundaries. Humans should return when the authority envelope itself must change. Execution authority binds identity to bounded work. The three dominant failure dimensions are time, state, and concurrency. 5. Three Ways a Legitimate Agent Becomes Wrong Most execution-governance failures can be understood through three dimensions: time, state, and concurrency. Time: authority changes An agent can retain valid credentials and permissions while a newer human or system decision supersedes its assignment. A newer authority should be able to invalidate the machine authority derived from the earlier instruction without disabling the actor itself. authority v17 → SUPERSEDED BY → authority v18 Long-running execution therefore needs explicit authority versioning and supersession semantics. State: reality changes If an agent reasons against repository head abc123 and another legitimate actor advances the repository to def456 , the original reasoning may no longer apply. The correct response is not to punish the agent. It is to invalidate the stale precondition. expected-base: abc123 ≠ current-base: def456 → REFRESH & RECONCILE Concurrency: legitimate actors collide Two agents may each have valid identity, valid permissions, approved tools, and legitimate assignments while their combined mutations remain unsafe. Parallel execution and safe parallel mutation are not the same thing. Permissions establish eligibility. Claims establish temporary operational ownership. A real implementation should use proven distributed-systems primitives such as leases, fencing tokens, atomic claims, optimistic concurrency, or version checks rather than inventing proprietary substitutes. The goal is not to keep the agent moving. The goal is to keep legitimate work moving. 6. Durable Execution Is Not Durable Authority Microsoft Agent Framework now provides checkpointing for long-running workflows. A checkpoint can capture executor state, pending messages, pending requests and responses, and shared state, and later restore workflow progress. 6 Human-in-the-loop requests can also survive checkpoints and be re-emitted on restoration. 7 That is exactly the kind of runtime capability serious long-running agent systems need. But checkpointing answers one question: where was execution? It does not necessarily answer another: should execution still continue? A valid checkpoint does not imply valid authority to resume. A workflow checkpointed Friday afternoon may wake Monday into a world where policy changed, the repository advanced, another workflow completed part of the task, a human changed the objective, or Production entered maintenance. GhostMesh calls the stronger recovery discipline authority-aware reentry : Restore execution state Refresh external reality Resolve current authority Check supersession Revalidate claims Revalidate target state Reassess human boundaries Continue or terminate The runtime restores mechanics. The control plane restores legitimacy. Checkpointing keeps work alive. Reentry determines whether that preserved state still deserves to act. 7. Four Invariants for Consequential Agent Execution The architecture can be reduced to four machine-enforceable invariants. No Authority, No Mutation. If current authority cannot be established, safe observation and analysis may continue, but consequential external state should not be created. No Fresh State, No Consequential Decision. If the state supporting the decision is stale, refresh and reconcile before acting. No Evidence, No Completion. If required proof is missing, the physical action may have occurred, but governed terminal success is not admitted. No Convergence, No Done. Individual agent success is insufficient until the intended durable state is established across relevant systems. Fail closed on consequence, not cognition When authority or state becomes uncertain, the system should preserve as much safe work as possible: reading, observing, reasoning, preparing, validating, and collecting evidence. It should constrain consequential mutation until legitimacy is restored. This avoids both bad extremes: freezing everything whenever uncertainty appears, and converting uncertainty into permission because the agent “seems competent.” Unknown is a first-class state A provider timeout does not necessarily mean failure. The request may never have arrived, may have started, may have completed, or may have succeeded while the response was lost. The correct state can be UNKNOWN , and unknown should trigger observation of the authoritative provider before retry. Provider quiet When consequential provider state is uncertain, stop adding new mutations long enough to establish what already happened. Provider quiet is not merely waiting. It is a deliberate control boundary that makes the external system observable again. Structured denial A useful denial should include a reason and a legal next state: refresh, wait, hand off, reconcile, collect evidence, escalate, or terminate. Governance should be part of the execution protocol, not a dead-end exception. Agent Hooks fits this philosophy unusually well. Microsoft documents fail-closed behavior at protected seams: deny blocks the action, invalid verdicts or interceptor failures do not silently bypass controls, and transforms are applied to the values execution actually uses. 4 The four invariants compress the failure doctrine. The lower half shows the larger architectural handshake between enterprise governance and execution legitimacy. 8. What Microsoft Brings, and GhostMesh Should Use A credible GhostMesh architecture should become smaller as enterprise agent infrastructure improves. Microsoft capability GhostMesh posture Why Entra Agent ID Consume Enterprise identity, authentication, lifecycle, ownership, access governance. Agent 365 Registry & Governance Consume / integrate Enterprise inventory, broad governance, policy distribution, observability. Defender Consume Threat protection and enterprise security correlation. Purview Consume Data governance, DLP, information protection, compliance. OpenTelemetry Adopt Standard execution and control telemetry alongside richer GhostMesh receipts. Agent Framework Evaluate as runtime Workflow, checkpoints, HITL, orchestration, runtime state. Agent Hooks Integrate Enforcement seam for GhostMesh authority decisions. MCP governance Consume where applicable Tool inventory, approval, and broad enterprise control. Microsoft's tool governance is especially instructive. Agent 365 currently governs tools primarily at the whole-tool level, and Microsoft's own guidance says function-level granularity is the next direction, for example allowing retrieval while blocking send or delete within the same tool. 5 GhostMesh should preserve a richer hierarchy: provider → tool → function → resource → operation → task → authority Tool approval means the capability exists and is generally permitted. It should not automatically mean every execution may use every operation against every resource right now. What GhostMesh should continue to own After subtracting commodity infrastructure, the differentiated core is surprisingly compact: Authority resolution Execution passports Resource claims Supersession Authority-aware reentry Execution receipts Convergence That is a healthier architecture. Identity plumbing is not the differentiator. Execution legitimacy may be. GhostMesh should build on Microsoft where Microsoft already has industrialized enterprise primitives, and retain only the semantics that remain strategically differentiating. 9. What Microsoft Should Consider Next The reverse question is equally useful: which execution-governance primitives could strengthen Microsoft's current architecture? This is not a claim that Microsoft has no internal mechanisms related to these ideas. It is an observation that they are not yet presented as equally central, unified abstractions in the public Agent 365 and Agent Framework architecture reviewed here. Task-scoped execution authority Authorize bounded work for a specific task, not merely broad standing capability. State-bound authorization Bind consequential actions to explicit expected state and preconditions. Temporary mutation claims Represent time-bound operational ownership of mutable surfaces. Explicit authority supersession Allow newer intent to invalidate older assignments without disabling the actor. Authority-aware checkpoint recovery Refresh reality and authority before durable execution resumes. Evidence-carrying execution Bind actor, authority, state, operation, validation, and outcome into a durable execution artifact. Desired-state convergence Declare completion only when the intended durable state is established across relevant systems. Agent Hooks could be the bridge Microsoft already has a plausible enforcement seam. Agent Hooks can intercept execution and return allow, deny, transform, warning, or approval-oriented outcomes, with fail-closed behavior at protected boundaries. 4 AGENT HOOKS = WHERE ENFORCEMENT HAPPENS GHOSTMESH-STYLE AUTHORITY = WHY EXECUTION IS ALLOWED The architectural opportunity is not to collapse the two layers. It is to standardize the interface between them. Microsoft already owns a credible runtime enforcement seam. The next frontier is progressively richer execution semantics and control leverage. 10. The Strategic Frontier Yesterday: How smart is the agent? The first wave of generative AI competition focused on model intelligence: understanding, reasoning, coding, and analysis. Today: What can the agent do? The frontier moved toward tools, MCP, connectors, workflows, multi-agent systems, and long-running execution. Microsoft correctly identifies tools as a major risk boundary because tools are what turn reasoning into external action. 5 Next: How much authority can we safely give it? Once capable models and tools become broadly available, the scarce resource becomes safe delegated authority . CONTROL LEVERAGE = USEFUL CONSEQUENTIAL MACHINE WORK ÷ HUMAN SUPERVISORY BURDEN The objective is to increase that ratio subject to authority, safety, evidence, recoverability, and convergence. This is not maximum autonomy. The useful target is maximum useful execution under explicit machine-enforced authority with minimum necessary human intervention. Better agents increase the value of control As reasoning, planning, tool use, execution duration, cross-system reach, and parallelism increase, potential consequence increases with them. The endpoint is unlikely to be a world where sufficiently intelligent agents no longer require sophisticated control. It is probably the opposite. Five questions for any “next-generation” agent-control architecture What is the unit of authorization? Identity, tool, function, resource, task, execution, or state transition? What happens when authority changes during execution? Can the actor remain valid while one assignment becomes invalid? How do multiple authorized agents avoid unsafe combined mutation? What actually arbitrates shared-state ownership? What happens when a workflow resumes into changed reality? Does it merely restore state, or revalidate authority and assumptions? How do you prove the system is actually done? Can it distinguish task completion from distributed convergence? The point at which the answers become vague identifies the current control boundary. GhostMesh has to pass the same test. If it claims state-transition governance, it must demonstrate deterministic authority resolution, bounded passports, real claims, reliable supersession, state freshness, authority-aware reentry, durable evidence, provider reconciliation, and credible terminal convergence. Not terminology. Not diagrams. Working mechanisms. The industry is independently converging on control as the limiting problem of enterprise agency. Microsoft approaches it from identity, security, management, and enterprise governance. GhostMesh approaches it from execution, changing authority, state, evidence, and convergence. Where those architectures meet may be more powerful than either one alone. The question for the next generation of enterprise AI is no longer merely, “How intelligent are the agents?” Nor even, “What can the agents do?” How much real authority can we safely give them? References Microsoft Agent 365 overview . Microsoft Learn. Microsoft Agent 365 documentation . Microsoft Learn. What is Microsoft Entra Agent ID? . Microsoft Learn. Agent Hooks, Microsoft Agent Framework . Microsoft Learn. How enterprises control what agents can do . Microsoft Learn. Agent Framework workflow checkpoints . Microsoft Learn. Agent Framework human-in-the-loop . Microsoft Learn. Scaling Agent 365 governance . Microsoft Learn. Agent Framework workflow capabilities . Microsoft Learn. GhostMesh Architecture . Canonical public architecture and closed-loop system model. GhostMesh Semantic OS . Authority, provenance, temporal context, supersession, evidence, and semantic admission. GhostMesh Sovereignty . Provider-aware, provider-independent execution, model, evidence, data, and exit sovereignty. GhostMesh Reference Implementation . SharePlane as the working reference implementation. About this work Authorship, evidence, and architecture boundary Author Tony Malott Work type Systems thesis Published August 27, 2026 Publication authority SharePlane Platform Issue #640 Presentation repair SharePlane Platform Issue #643 GhostMesh source ghostmesh.ai/architecture Reference implementation SharePlane Microsoft product statements are grounded in current Microsoft primary documentation. GhostMesh definitions are grounded in the canonical GhostMesh public architecture. The comparison, state-transition governance synthesis, recommendations to Microsoft, and control-leverage framing are Tony Malott's architecture analysis. AI assistance covered research, editorial refinement, visual production, publication implementation, validation, and provenance serialization under Tony's owner authority. Inspect machine-readable artifact and provenance Read portable context Inspect publication receipt Connected work Continue the thinking Each connection explains why the next work belongs here. The graph records the edge; this layer makes it useful to a reader. Foundations Companion: The Agent Is Not the Product. The Control Plane Is. The Agent Is Not the Product. The Control Plane Is. The control-plane thesis establishes the durable product around agents; this Work compares that principle with Microsoft's Agent 365 enterprise governance substrate. The more useful an agent becomes, the less its safety can depend on the agent behaving well. The durable product is the governed execution environment around it. Reader Choice Publication Family By Tony Malott 2026-07-23 complete standalone reading experience · Personal systems narrative, Architecture argument, Enterprise warning Companion: The Agent Is Not the Security Boundary The Agent Is Not the Security Boundary The security-boundary thesis separates model capability from surrounding system controls; this Work extends the distinction into current execution authority, state, claims, and convergence. Do not ask whether the agent is trustworthy. Ask whether the system remains safe when the agent is wrong. Systems Essay By Tony Malott 2026-07-25 16 min · Standard long-form article Explore the complete graph SOURCE REFERENCES Microsoft Agent 365 and Microsoft Agent Framework documentation https://learn.microsoft.com/en-us/microsoft-agent-365/ GhostMesh Architecture https://ghostmesh.ai/architecture/ Publish When Agent Identity Is Not Enough — Agent 365 / GhostMesh SharePlane thesis https://github.com/pinklon/shareplane-platform/issues/640