For thirty years we defended a perimeter. We decided who could get in, and once they were in, we mostly trusted what they did. Identity got a role, the role got permissions, and the permissions followed the actor into everything that came next. That model worked for software with a stable, predictable function.
AI agents break it. An agent interprets changing context, chains tools together, chooses its next step, and acts on information nobody anticipated when its permissions were assigned. Every identity control can work exactly as designed while the resulting action is still wrong.
So the control point has moved. It is no longer the network edge or the login. It is the moment of inference and the action that follows — the instant an agent decides to move money, change a record, or send data across a boundary.
That is the new perimeter, and it needs a different kind of control: not "who is this actor," but "should this specific action, with this blast radius, be allowed to happen right now, and can it be taken back." Authorize the action, not just the actor. Evaluate it at execution time against its purpose, its consequence, and its reversibility. Observe first, enforce where it matters, and keep a human in the loop for the decisions that cannot be undone.
Capability is commoditising. The unsolved problem is delegation — giving a machine real authority and still being able to take it back. That is where the next serious AI failure will come from, and it is where the control has to live.