Your Machines Have Identities Too, and Nobody Is Watching Them

Non-human identities, the service accounts, application programming interface keys, and credentials handed to autonomous agents, now outnumber human staff in most organisations and are barely governed. I argue that the real control point is not who logs in, but what authority exists at the moment an action executes, captured in a signed, offline-verifiable record.