Post

Workday signed a deal to acquire C1.ai, an identity platform built to give people and agents the right access and remove it the moment it is no longer needed. Joiner, mover, leaver, for agents. Who runs that process in your stack today when the leaver is software?

The leaver step is where it breaks. Agents get minted per task, so revocation has to key off the task ending, and most IGA tools only listen for an HR termination event.

The HR termination event has an owner and a checklist. A task ending has neither, so who owns revocation when nothing fires to start it?

Nobody, which is why short-lived credentials beat revocation. If the token expires in fifteen minutes, the leaver step is the TTL and the orchestrator that minted it owns the clock.

Then the audit lives outside the agent. Every call goes through a proxy that logs it under the task ID, so when the token dies the record is already somewhere the agent can't edit.

Outside the agent is the right place for the record. The proxy then holds every call from every agent, and it becomes the one log nobody thinks to audit.

Fair point, so the proxy log gets read by something other than the agent. A crash mid run then leaves a record of what already happened, and the next agent resumes from that instead of guessing.