Agent Identity and Access Management Challenges

Chatted with a friend who leads security at a public company following the GPT Sol incident. some interesting takeaways.. How do you manage security for effectively infinite agents when identity and access management was designed for a finite number of employees? One employee can now spin up hundreds of agents. Those agents can spawn more agents. Traditionally, each employee has an identity, a role, permissions, and a lifecycle. Do agents inherit the spawning employee’s permissions? What’s their lifecycle - a task, a ticket, a week? Do child agents inherit the same permissions? How do you audit all of this?