A new GuidePoint Security piece cuts through the abstraction around agentic AI risk by reducing it to three blunt questions every enterprise should be able to answer: where are my agents, what can they connect to, and what can they do. The framing matters because it names the actual failure mode driving current incidents — agents accumulating access that nobody scoped, tracked, or can revoke on demand. The guidance treats identity as the mandatory starting layer, not an add-on. It argues that any workable approach has to layer onto identity providers and gateways organizations already run, rather than forcing a rip-and-replace, and that every agent needs a first-class identity regardless of which framework, cloud, or SaaS platform it runs on. What's notable is the emphasis on shadow AI: the guidance calls for the ability to register and manage homegrown agents, import known agents from external platforms, and surface unregistered ones through signals such as OAuth consent grants. That's a tacit admission that most organizations currently have no inventory of what's already acting on their behalf — a gap that shows up repeatedly across vendor writing this year, but rarely gets stated as plainly as 'where are my agents?' From there the recommended posture gets specific: govern connections to internal APIs, secrets, service accounts, applications, and MCP servers with scoped, short-lived access rather than standing credentials. And at runtime, evaluate agent actions against policy, with human-in-the-loop approval reserved for high-stakes actions, centralized audit logs for review, and — critically — a kill switch that can cut an agent's access the moment something goes wrong. The kill switch detail is worth dwelling on. Most identity frameworks for humans assume offboarding happens on a predictable schedule — a resignation, a role change. Agents don't offboard that way. An agent can be compromised, drift into unintended behavior, or simply be given a task that turns out to touch more than it should, all within seconds. A governance model that only reviews access quarterly or logs it after the fact doesn't help if there's no mechanism to interrupt an agent mid-action. The piece's insistence on run-time evaluation, not just onboarding-time provisioning, is the part that distinguishes it from a generic 'give agents an identity' pitch — it's asking for continuous authority to say no, not just a one-time badge. The underlying claim is unglamorous but correct: identity infrastructure that was designed to onboard and offboard humans on human timescales isn't automatically adequate for entities that can enumerate a company's systems faster than any employee could notice.