Most authorization systems still answer one question: is this credential valid? A new proposal from the Cloud Security Alliance argues that question is no longer sufficient once the actor holding the credential can improvise. A CSA blog post from Saviynt's Tuhin Banerjee introduces "Mean Time to Understand" (MTU) as a metric for identity and access governance in agentic systems. The framing starts from a simple observation about how agents behave differently from the humans and static service accounts that IAM was built around: they generate plans, select tools dynamically, and change course mid-execution, all faster than traditional authorization systems can evaluate. MTU is meant to measure something authorization systems have never had to measure before: not whether a credential checks out, but how long it takes a system to understand what an agent is actually trying to do before deciding whether to let it. The metric covers the time required to interpret an agent's intent, plan, toolchain, and data flows well enough to make a safe, compliant authorization decision. In other words, authorization stops being a lookup and becomes a comprehension problem with a clock attached. This lands in the same territory CSA has been mapping all year. A companion CSA paper on agent identity governance notes that non-human identities already outnumber human identities by more than 90 to 1 in many organizations, with some reporting ratios as high as 144 to 1, and that this population grew 44 percent in a single year. The gap isn't just volume — it's that each of those identities can now reason about its own access needs and request new permissions on the fly, which is exactly the behavior MTU is trying to put a number on. What makes MTU worth noting isn't the acronym — SLOs get invented constantly — it's what it implies about where the authorization bottleneck actually sits. If the binding constraint on safely deploying an agent isn't cryptographic (do we trust the key) but interpretive (do we understand the plan), then a lot of the DID/VC/zero-trust plumbing CSA and others have proposed solves necessary but insufficient problems. You can have a perfectly verified agent identity and still authorize an action nobody understood in time to stop it. Treating comprehension speed as a governed metric, rather than an afterthought, is a small but real shift in how the authorization layer for agents might get built and audited. It's an early proposal, not a shipped standard, and CSA papers don't carry regulatory weight on their own. But it's a useful marker of where the identity-and-access conversation for agents is moving next: from proving who an agent is toward proving, on a clock, that the systems granting it access actually understood what it was about to do.