When Agent Identity Is Not Enough

1. Microsoft Just Validated the Problem

Agent 365 came up recently in a technical discussion about controlling enterprise AI agents. I had not followed the product closely, so I went looking.

The deeper I got, the more familiar the problem became.

Microsoft now explicitly positions Agent 365 as the control plane for enterprise agents: a centralized layer for observing, governing, and securing agents across an organization. It is generally available, provides a unified registry, and ties agent governance into Microsoft Entra, Purview, Defender, and the Microsoft 365 administration plane.¹²

Microsoft is also making agent identity a first-class enterprise primitive. Entra Agent ID extends enterprise authentication, authorization, lifecycle governance, ownership, sponsorship, access protection, and audit concepts to non-human AI actors.³

That is serious infrastructure. It is also remarkably familiar.

For more than a year I have been developing an architecture called GhostMesh around a related problem: how increasingly capable AI systems can perform consequential, long-running work without losing human authority, operating from stale state, colliding with other executors, or declaring success before the surrounding systems have actually reached the intended outcome.

The canonical public architecture is documented at GhostMesh.ai. Its Semantic OS, sovereignty model, and closed-loop execution doctrine define the architecture; SharePlane is the working reference implementation, not an architectural dependency.^10111213

The overlap is not evidence that Microsoft copied GhostMesh. Nor would it be credible to pretend an independently developed architecture is commercially equivalent to Microsoft's global identity, security, compliance, and management platforms.

That is the useful observation. Microsoft independently arrived at the same underlying premise.

For much of the current AI cycle, the industry focused on intelligence: can the model understand, reason, plan, use tools, coordinate with other agents, and operate for longer periods? Each improvement expands what machines can accomplish. It also expands what machines can affect.

Once an agent can modify code, update enterprise records, communicate externally, alter infrastructure, invoke tools, access sensitive information, or coordinate other agents, model capability stops being the only important architectural question.

Another question appears: under whose authority is all of this happening?

Agent 365 is Microsoft's increasingly comprehensive answer at the enterprise-governance layer. But controlling the agent is not necessarily the same thing as controlling the work.

2. Four Control Planes

The easiest way to understand the relationship is to stop treating “agent control” as one problem. It is several.

The layers overlap, but they should not silently redefine one another. Entra should remain authoritative for enterprise identity. Agent 365 should remain authoritative for broad enterprise agent governance. A runtime should own actual runtime state. The underlying provider should remain authoritative for the resources it owns.

GhostMesh can then own something narrower: the legitimacy and convergence of consequential work across those systems.

3. The Five Green Lights Problem

Suppose an enterprise agent is preparing to modify Production. Every conventional governance check is green:

Should the operation proceed? Not necessarily.

Perhaps Production was paused five minutes ago. Another executor may have acquired ownership of the deployment lane. The target state may have changed since the agent reasoned about it. The task may have been superseded. The approval may have expired.

This is the Five Green Lights Problem. Identity can remain valid while the current work loses legitimacy.

A permission says, “You are generally eligible to perform this class of action.” Execution authority says, “You are currently authorized to perform this particular action for this particular piece of work.” Those controls operate at different timescales.

This is also why revoking an entire identity or disabling a tool is often the wrong response. If one assignment becomes obsolete while the agent remains valid for other work, the system needs a narrower control primitive than account revocation.

4. State-Transition Governance

The Five Green Lights Problem leads to a more precise formulation. Traditional authorization asks about actor, resource, action, and policy. Consequential agent execution adds task, current authority, expected state, temporary ownership, time, concurrency, supersession, and human boundaries.

The question changes from:

May Agent A write to Repository X?

to:

May Agent A perform this specific transition against Repository X, from its current state, for this assignment, under the authority that exists right now?

That is state-transition governance.

An advanced agent is not merely a strange new kind of enterprise user. It is also a state-transition engine. Identity management gives us roles, credentials, permissions, and access policies. Distributed-systems engineering gives us preconditions, leases, fencing, compare-and-swap, idempotency, versioning, and reconciliation. Serious agent control increasingly needs both.

The execution passport

A useful GhostMesh abstraction is an execution passport: a short-lived, machine-readable description of bounded delegated work. It can bind an enterprise actor to a task, resource scope, expected state, permitted and prohibited operations, temporary claim, expiry, human boundaries, and required evidence.

The passport does not replace Entra or enterprise IAM. It assumes standing enterprise authorization already exists. Both controls must succeed.

Continuous execution authorization

Authorization becomes temporal. “Authorized at 14:00” does not imply “authorized at 14:30,” even if the identity, credential, enterprise permission, and tool remain unchanged.

This does not mean asking a human before every tool call. Machine-readable authority should be refreshed at meaningful mutation boundaries. Humans should return when the authority envelope itself must change.

5. Three Ways a Legitimate Agent Becomes Wrong

Most execution-governance failures can be understood through three dimensions: time, state, and concurrency.

Time: authority changes

An agent can retain valid credentials and permissions while a newer human or system decision supersedes its assignment. A newer authority should be able to invalidate the machine authority derived from the earlier instruction without disabling the actor itself.

Long-running execution therefore needs explicit authority versioning and supersession semantics.

State: reality changes

If an agent reasons against repository head abc123 and another legitimate actor advances the repository to def456, the original reasoning may no longer apply. The correct response is not to punish the agent. It is to invalidate the stale precondition.

Concurrency: legitimate actors collide

Two agents may each have valid identity, valid permissions, approved tools, and legitimate assignments while their combined mutations remain unsafe. Parallel execution and safe parallel mutation are not the same thing.

Permissions establish eligibility. Claims establish temporary operational ownership. A real implementation should use proven distributed-systems primitives such as leases, fencing tokens, atomic claims, optimistic concurrency, or version checks rather than inventing proprietary substitutes.

6. Durable Execution Is Not Durable Authority

Microsoft Agent Framework now provides checkpointing for long-running workflows. A checkpoint can capture executor state, pending messages, pending requests and responses, and shared state, and later restore workflow progress.⁶ Human-in-the-loop requests can also survive checkpoints and be re-emitted on restoration.⁷

That is exactly the kind of runtime capability serious long-running agent systems need.

But checkpointing answers one question: where was execution?

It does not necessarily answer another: should execution still continue?

A workflow checkpointed Friday afternoon may wake Monday into a world where policy changed, the repository advanced, another workflow completed part of the task, a human changed the objective, or Production entered maintenance.

GhostMesh calls the stronger recovery discipline authority-aware reentry:

1. Restore execution state
2. Refresh external reality
3. Resolve current authority
4. Check supersession
5. Revalidate claims
6. Revalidate target state
7. Reassess human boundaries
8. Continue or terminate

The runtime restores mechanics. The control plane restores legitimacy.

7. Four Invariants for Consequential Agent Execution

The architecture can be reduced to four machine-enforceable invariants.

Fail closed on consequence, not cognition

When authority or state becomes uncertain, the system should preserve as much safe work as possible: reading, observing, reasoning, preparing, validating, and collecting evidence. It should constrain consequential mutation until legitimacy is restored.

This avoids both bad extremes: freezing everything whenever uncertainty appears, and converting uncertainty into permission because the agent “seems competent.”

Unknown is a first-class state

A provider timeout does not necessarily mean failure. The request may never have arrived, may have started, may have completed, or may have succeeded while the response was lost. The correct state can be UNKNOWN, and unknown should trigger observation of the authoritative provider before retry.

Provider quiet

When consequential provider state is uncertain, stop adding new mutations long enough to establish what already happened. Provider quiet is not merely waiting. It is a deliberate control boundary that makes the external system observable again.

Structured denial

A useful denial should include a reason and a legal next state: refresh, wait, hand off, reconcile, collect evidence, escalate, or terminate. Governance should be part of the execution protocol, not a dead-end exception.

Agent Hooks fits this philosophy unusually well. Microsoft documents fail-closed behavior at protected seams: deny blocks the action, invalid verdicts or interceptor failures do not silently bypass controls, and transforms are applied to the values execution actually uses.⁴

8. What Microsoft Brings, and GhostMesh Should Use

A credible GhostMesh architecture should become smaller as enterprise agent infrastructure improves.

Microsoft's tool governance is especially instructive. Agent 365 currently governs tools primarily at the whole-tool level, and Microsoft's own guidance says function-level granularity is the next direction, for example allowing retrieval while blocking send or delete within the same tool.⁵

GhostMesh should preserve a richer hierarchy:

Tool approval means the capability exists and is generally permitted. It should not automatically mean every execution may use every operation against every resource right now.

What GhostMesh should continue to own

After subtracting commodity infrastructure, the differentiated core is surprisingly compact:

• Authority resolution
• Execution passports
• Resource claims
• Supersession
• Authority-aware reentry
• Execution receipts
• Convergence

That is a healthier architecture. Identity plumbing is not the differentiator. Execution legitimacy may be.

9. What Microsoft Should Consider Next

The reverse question is equally useful: which execution-governance primitives could strengthen Microsoft's current architecture?

This is not a claim that Microsoft has no internal mechanisms related to these ideas. It is an observation that they are not yet presented as equally central, unified abstractions in the public Agent 365 and Agent Framework architecture reviewed here.

Agent Hooks could be the bridge

Microsoft already has a plausible enforcement seam. Agent Hooks can intercept execution and return allow, deny, transform, warning, or approval-oriented outcomes, with fail-closed behavior at protected boundaries.⁴

The architectural opportunity is not to collapse the two layers. It is to standardize the interface between them.

10. The Strategic Frontier

Yesterday: How smart is the agent?

The first wave of generative AI competition focused on model intelligence: understanding, reasoning, coding, and analysis.

Today: What can the agent do?

The frontier moved toward tools, MCP, connectors, workflows, multi-agent systems, and long-running execution. Microsoft correctly identifies tools as a major risk boundary because tools are what turn reasoning into external action.⁵

Next: How much authority can we safely give it?

Once capable models and tools become broadly available, the scarce resource becomes safe delegated authority.

The objective is to increase that ratio subject to authority, safety, evidence, recoverability, and convergence.

This is not maximum autonomy. The useful target is maximum useful execution under explicit machine-enforced authority with minimum necessary human intervention.

Better agents increase the value of control

As reasoning, planning, tool use, execution duration, cross-system reach, and parallelism increase, potential consequence increases with them. The endpoint is unlikely to be a world where sufficiently intelligent agents no longer require sophisticated control. It is probably the opposite.

Five questions for any “next-generation” agent-control architecture

1. What is the unit of authorization? Identity, tool, function, resource, task, execution, or state transition?
2. What happens when authority changes during execution? Can the actor remain valid while one assignment becomes invalid?
3. How do multiple authorized agents avoid unsafe combined mutation? What actually arbitrates shared-state ownership?
4. What happens when a workflow resumes into changed reality? Does it merely restore state, or revalidate authority and assumptions?
5. How do you prove the system is actually done? Can it distinguish task completion from distributed convergence?

The point at which the answers become vague identifies the current control boundary.

GhostMesh has to pass the same test. If it claims state-transition governance, it must demonstrate deterministic authority resolution, bounded passports, real claims, reliable supersession, state freshness, authority-aware reentry, durable evidence, provider reconciliation, and credible terminal convergence. Not terminology. Not diagrams. Working mechanisms.

Microsoft approaches it from identity, security, management, and enterprise governance. GhostMesh approaches it from execution, changing authority, state, evidence, and convergence.

Where those architectures meet may be more powerful than either one alone.

The question for the next generation of enterprise AI is no longer merely, “How intelligent are the agents?” Nor even, “What can the agents do?”

How much real authority can we safely give them?