There’s a secret sitting in your infrastructure right now.

Not because your team messed up, but because this is how we’ve built systems for the last 20 years. A service needed to talk to a database, so you gave it a password. A pipeline needed to push an image, so you gave it a token. A Lambda needed S3 access, so you gave it a key.

That was the model. Software needed to prove who it was, so we gave it something to present.

Those “somethings” are still everywhere. Environment variables, Kubernetes secrets, CI configs, and sometimes – in the worst cases – a public repo. They don’t expire. They don’t tell you when they’re used. And when one leaks, you don’t find out until it’s already a problem.

Then you rotate everything, burn a few weeks of engineering time, and hope it doesn’t happen again.

That’s not a failure of teams. It’s a failure of the model.

The secret era

Early machine identity was simple because infrastructure was simple. Servers were static. Workloads didn’t move. You knew what was running where.

So you handed out credentials at deploy time and trusted nothing would change fast enough to matter.

That trust didn’t hold. It just took a decade of breaches to make it obvious.

SolarWinds, CircleCI, Uber. Different companies, same pattern. A credential got exposed, and because it was long-lived and over-permissioned, it worked. It worked long enough for attackers to move laterally, escalate privileges, and extract what they came for.

In every case, the credential wasn’t just part of the attack surface. It was the attack surface.

We made secrets better – we didn’t remove them

The industry’s first real response was secrets management.

Tools like Vault improved things. Short-lived credentials, just-in-time issuance, and audit trails were all meaningful. It introduced the idea that credential lifetime is itself a control.

But the model didn’t actually change, it just got faster.

A workload still needed a credential, and Vault just made that credential expire sooner. And once that credential was handed off, visibility stopped. You knew it was issued, but you didn’t know what happened next.

And to get a credential from Vault in the first place, the workload still needs something. And that something was usually another credential, one level up.

The shift: identity without secrets

Then SPIFFE showed up and changed the framing entirely.

Instead of giving workloads something to present, it asked a different question. Can the platform attest to what this workload is?

If you know where something is running, what it’s running as, and what environment it’s in, that becomes its identity. No password, no token, no key. Just proof derived from context.

SPIRE operationalized that with short-lived certificates and automatic rotation. Cloud providers arrived at similar answers with identity access management (IAM) roles and managed identities.

This was a real shift, and the industry moved from managing secrets to establishing identity.

The assumption nobody questioned

For a while, that was enough. All of these systems share one assumption, even if it’s never stated out loud: the workload knows what it’s going to do before it starts.

You define identity upfront. You define permissions upfront. You define policy upfront because workloads were predictable. Same inputs, same outputs, same dependencies.

That predictability is what made the whole model work.

Static topology makes policy possible, and deterministic behavior makes policy reliable.

The workload that decides

That assumption is now breaking, since AI agents don’t follow that model.

AI agents don’t execute a fixed path. They decide the path at runtime. They get a goal, figure out how to achieve it, call tools, chain APIs, and sometimes reach systems you didn’t even expect them to touch.

In fact, that’s not even considered a bug. That’s the feature. The problem is it breaks everything that came before.

You can give an agent an identity. You can give it a role. You can give it short-lived credentials. None of that tells you what it’s going to do next, and none of it stops it when it goes off script.

Identity isn’t enough anymore

The current stack answers one question really well: Is this workload who it claims to be?

What it doesn’t answer is the question that actually matters now: What is this workload doing right now?

For traditional systems, that gap was small. If you knew who the workload was, you could reasonably predict what it would do.

For agents, that gap is the entire problem.

You can’t predefine every path. You can’t write policy for decisions that haven’t been made yet. You need something that follows the workload as it acts, not just when it starts.

Identity in motion

There is one layer that already sees everything an agent does. Say it with me, friends: The network.

Every call, every connection, every request. If identity lives there, it moves with the workload. Every connection can be authenticated. Every action can be observed. Every connection can be controlled in real time.

Not just predicted. Enforced.

You don’t have to guess what the workload will do. You see what it is doing and decide whether it should continue. And that’s the shift that will make the difference when, well, shift happens.

Where this is going

The industry isn’t guessing about this anymore.

In the last few months, Microsoft, Cisco, and Okta have all published major positions on agentic security. RSA was full of sessions on AI agent identity. The Cloud Security Alliance reports that 88% of organizations have already experienced an AI agent-related security incident, while only 22% treat agents as first-class identities.

The industry just finished solving credentials. Then it solved workload identity.

Now it has to solve something harder.

Agency.

Not just who something is. Not just what it was allowed to do. But what it’s actually doing, right now.

The credential solved secrets. Workload identity solved credentials. What comes next has to account for behavior.

And the layer that consistently sees those actions is the one that was always there.

The network. In a mesh overlay network, every device, service, or workload gets a cryptographic identity managed by the control plane. Not a credential you distribute manually, but one that travels with the node wherever it runs. Agents follow the same model, and not a special case or new framework. An identity aware gateway can pick up identity directly from the network, with no separate credentials to issue or rotate. The identity of the node making the request determines what it can reach.

So what comes next?

The title of this piece asks a question. Here is my answer.

Not a new paradigm. Not a new category. The continuation of a trajectory that started the moment someone asked why a machine still needed a password.

Secrets management shortened the window of exposure. Workload identity removed the secret from the equation. What comes next starts to close the gap between identity and action, the gap that agents expose by deciding things at runtime that no policy written at deploy time could have anticipated.

There is still something sitting in your infrastructure right now. But now, there is a layer that does more than know what something is. It starts to follow what it does, and limit what it can reach.

This may be what comes next. Useful, especially when your infrastructure has opinions.