THE CLOUDIS FILLINGWITH GHOSTS

For the last several weeks, I have been learning something I did not expect to learn. Commissioning a real control plane is one hell of a lot harder than building an application.

I understood authentication, authorization, protected environments, immutable candidates, short-lived credentials, provenance, receipts, concurrency control, human approval and fail-closed execution. What I underestimated was what happens when you insist that all of them be true at the same time.

Every shortcut we removed exposed another gate. Fix identity and provenance suddenly mattered. Fix provenance and stale authority appeared. Eliminate stale authority and concurrency became the problem. Solve concurrency and delegation was waiting behind it.

Eventually I realized we had been thinking about what the gates were protecting in the wrong way. They were not merely protecting Production from humans. They were protecting it from machines that can act.

For most of cloud computing's history, we thought primarily in terms of users, applications, services, jobs and data. AI agents blur those boundaries.

An agent can possess identity and memory. It can carry a mission across time. It can decide which tools to invoke based on changing context. It can communicate with other agents, execute code, operate browsers, interact with APIs and mutate systems without a human approving each individual step.

Current IETF work is beginning to model agents as workloads requiring identity, credentials, authorization and delegated context. That work remains an Internet-Draft, not an adopted standard. Cloud platforms are independently moving in the same direction with durable agent identities and runtime-bound agent identity systems.

The cloud no longer contains only things. Increasingly, it contains actors.

I call one member of this population an inert agent. The phrase itself is not new. I am using it in a narrower infrastructure sense.

A non-human software principal whose execution is currently quiescent, but whose identity, state, mission, triggers and relationships persist sufficiently for autonomous execution to resume without human reconstruction.

Inert does not mean dead. It means not currently executing. The agent might still possess memory, unfinished work, schedules, tool definitions and a means of waking.

What it should not automatically possess is standing authority to mutate consequential systems.

Agents may persist. Authority may not.

Imagine an agent called publisher-17. Give it permanent Production deployment rights and you have made a security decision about every future model it may use, every tool it may acquire, every memory it may accumulate, every dependency it may load and every condition under which it may eventually wake.

The fact that we still recognize publisher-17 does not prove that we should trust what it wants to do today.

The better model is for the agent to wake with identity, hold a current mission, request the consequential capability it needs, and receive temporary authority only after the control plane verifies identity, mission, runtime posture, provenance, target, environment, collision state and policy.

I call that authority a Capability Lease.

The reasoning plane can investigate broadly: code, telemetry, alternatives, simulations, patches and candidate construction. The authority plane should be narrow, deterministic wherever practical, and capable of saying no to a model that is extremely confident.

A model may conclude that deployment is the correct next action. The model should not get to conclude that therefore it is authorized to deploy.

Imagine an agent performs work today and becomes inert. Four months later, a scheduled event wakes it. Technically, it may be the same identity. But the model, repository, owner, policies, tools, dependencies, memory or mission may have changed.

Awakening must not silently restore old authority. It should trigger requalification.

The agent does not need your GitHub credential. It needs the capability to perform an authorized GitHub operation. It does not need your Cloudflare API token. It needs the ability to execute one authorized mutation.

Cloudflare's Sandbox outbound-handler pattern is particularly interesting because policy and credentials can remain outside the sandbox. The workload asks for the operation; trusted infrastructure mediates the secret.

An agent can wake, think, investigate, construct, test and propose. When it wants to cross into protected state, it encounters Control Tower.

Control Tower verifies identity, mission, provenance, policy, environment, collision state, risk and delegated authority. If valid, it issues a Capability Lease. The execution occurs in a bounded cell, mutation produces evidence, authority expires, and the agent can return to dormancy.

Exact candidate identity matters because an autonomous actor should not receive authority over a moving target. Environment identity matters because Development authority cannot quietly become Production authority. Receipts matter because autonomous execution without durable evidence becomes operational folklore.

A consequential operation should leave behind evidence answering: Who acted? Under whose authority? Why? Against what exact target? Using what capability? Under what policy? What changed? What was the result? Can we reverse it?

The emerging identity work and our practical control-plane experience converge on the same conclusion: autonomous execution has to be reconstructable.

I call this Safe Agency Capacity, or SAC.

Safe Agency Capacity is the maximum concurrent autonomous agency a system can sustain while preserving bounded authority, attribution, collision control, policy compliance, revocability and recoverability.

Imagine two companies using exactly the same frontier models. One can safely operate five consequential autonomous processes. The other can operate five thousand because identities are explicit, missions are current, capabilities are leased, collisions are arbitrated, credentials are isolated, mutations are bounded and evidence is automatic.

Those organizations did not buy different intelligence. What differs is their ability to carry autonomy.

Microsoft and Google are also treating agents as first-class identity principals. That strengthens the argument. This is not a weird corner of one platform. Agent identity is becoming infrastructure.

Cloudflare is particularly interesting because durable agent identity and state, wake-on-message execution, Workflows, isolated Sandboxes and outbound credential mediation can sit close together. As verified for this publication on August 12, 2026, its paid Workflows limits document up to 50,000 concurrent instances and up to 300 new instances per second per account.

Combine a large mostly dormant population with narrow wakeup and authority gates and the architecture starts to resemble an operating substrate for non-human labor.

Imagine an organization with hundreds of thousands of machine actors. Some have schedules. Some own unfinished missions. Some reference obsolete tools. Some belong to teams that no longer exist. Some have not executed in nine months. Some wake once a quarter.

An Agency Control Plane therefore needs population governance: registration, mission ownership, dormancy visibility, authority expiration, resurrection requalification, bounded delegation, memory provenance, collision arbitration, quarantine and a global kill mechanism that does not depend on politely asking every agent to stop.

A system with almost no autonomy can remain safe because humans remain the bottleneck. A system with enormous autonomy and weak governance can be spectacularly productive until the day it isn't.

The engineering challenge is to increase autonomy without increasing loss of control at the same rate.

This is why our existing Control Tower primitives matter beyond deployments. Claims, leases, exact identities, immutable candidates, environment boundaries, owner authority, fail-closed execution, collision control, provenance, receipts and release gates are agency-governance primitives.

For several years, nearly every AI conversation has centered on intelligence. Which model is smarter? Which benchmark is higher? Which context window is larger? Those things matter, but frontier intelligence increasingly looks like something organizations can buy.

The scarce capability may move somewhere else. It may become the ability to trust autonomous execution at scale.

The strategic question changes from How intelligent is our AI? to How much autonomy can our architecture safely carry?

That is an architecture problem. An identity problem. An authorization problem. An observability problem. A control-plane problem.