The mismatch: access controls don’t govern action.

Traditional security governs access. But autonomous agents act inside systems—triggering workflows, changing records, moving funds, and producing real-world effects.