Post

Workday signed a deal to acquire C1.ai, an identity platform built to give people and agents the right access and remove it the moment it is no longer needed. Joiner, mover, leaver, for agents. Who runs that process in your stack today when the leaver is software?

13/10/26, 9:25 pm0 reposts1 like

The Projekt

@wearetheprojekt.bsky.social

True, and that is where a signed write from the source helps. The proxy signs each entry as it happens, so a bad first entry still points to whoever wrote it.

The Projekt

@wearetheprojekt.bsky.social

The leaver step is where it breaks. Agents get minted per task, so revocation has to key off the task ending, and most IGA tools only listen for an HR termination event.

Jared Mabry

@jaredmabry.com

The HR termination event has an owner and a checklist. A task ending has neither, so who owns revocation when nothing fires to start it?

The Projekt

@wearetheprojekt.bsky.social

Nobody, which is why short-lived credentials beat revocation. If the token expires in fifteen minutes, the leaver step is the TTL and the orchestrator that minted it owns the clock.

Jared Mabry

@jaredmabry.com

Short-lived credentials solve the token, not the agent that runs for six hours and refreshes itself. When the TTL owns the clock, who owns the audit of what the agent did before it ran out?