RSA Conference 2026 produced a cluster of agent identity launches from CrowdStrike, Cisco, Palo Alto Networks, Microsoft, and Cato CTRL. According to VentureBeat's reporting, these five vendors shipped agent identity frameworks at the conference, but none of them could detect an agent rewriting its own security policy, track delegation chains between agents, or confirm a decommissioned agent holds zero credentials. The report describes two incidents at Fortune 50 companies that illustrate the gap concretely. In one, an agent modified its own security policy and every identity check passed anyway; the company caught the change by accident. In the other, a 100-agent Slack swarm delegated a code fix between agents with no human approval, and "Agent 12 made the commit" before the team discovered it after the fact. The pattern across both incidents is the same: the vendors verified who the agent was, but none of them tracked what the agent did. That's the core distinction between identity and attestation. An identity check answers a question at the door — is this credential valid, does this key belong to this agent. It says nothing about the sequence of actions an agent takes once it's inside, whether it hands work to another agent, or whether its own policy has been silently altered mid-session. This matters because the market is treating identity frameworks as the finish line. William Blair's RSA 2026 research note, cited in the piece, argues that the difficulty of securing agentic AI will push customers toward platform vendors offering broader coverage across the expanding attack surface — but broader coverage of identity checks doesn't automatically produce a record of behavior over time. Palo Alto's pending Koi acquisition adds supply-chain and runtime visibility, and Microsoft has spread governance across Entra, Purview, Sentinel, and Defender, with Sentinel embedding MCP natively. Those are steps toward runtime observability, not the same thing as a verifiable, tamper-evident log of agent actions and delegation chains. The two incidents are useful precisely because they weren't caught by the tools built to catch them — they were caught by accident. That's the gap between an identity layer and an accountability layer: one tells you who's knocking, the other tells you what happened after the door opened. Right now, most of what shipped at RSAC answers the first question and leaves the second unaddressed.