On July 29, Delinea announced runtime authorization capabilities for AI agents, positioning itself as enforcing policy on agent actions inside a session rather than only at the connection boundary. As the release describes it, Delinea is "the identity security platform that governs what humans, machines, and AI agents do once they have access," and the new capability is meant to make it possible to "enforce policy on what agents do inside a session before they act, not just how they connect." This distinction matters because most agent-identity infrastructure shipped so far, workload federation, short-lived tokens, SPIFFE-style attestation, answers a narrower question: is this agent who it claims to be, and does it hold a valid credential to open a session? None of that says anything about what the agent does once inside. An agent can present a perfectly valid credential to a Kubernetes cluster or cloud console and still issue a destructive command, exfiltrate data, or chain calls in a way no one anticipated. The release notes that agents now operate "autonomously across production databases, SSH hosts, Kubernetes clusters, cloud consoles, and MCP servers" — a footprint wide enough that connection-time checks alone leave a lot of surface uncovered. This is squarely an attestation-layer problem: the value isn't just blocking bad actions, it's producing an enforceable, checkable record of what was permitted and what wasn't, tied to a specific agent run rather than a shared service account. Other vendors have been circling the same gap from the identity side — CrowdStrike's Continuous Identity push argues that a trust decision valid at login can be invalid moments later, and industry playbooks on non-human identity have been pushing toward attribution to a specific agent run rather than a generic automation account, since a log line crediting "the automation user" with a few thousand actions doesn't reconstruct an incident. What's notable about the Delinea move is the timing relative to that broader conversation: it's one of the first named commercial products to claim in-session policy enforcement specifically for agents, rather than pre-session credentialing. Whether it holds up under real deployment — false-positive rates, latency cost of per-action policy checks, coverage across MCP and other emerging agent protocols — is the open question the announcement itself doesn't answer. But the shift in framing, from "can this agent get in" to "what is this agent allowed to do right now, and can we prove it later," is the more interesting signal than the vendor name attached to it.