Data is king. Access decides who rules.

Garry Tan, head of Y Combinator, predicted last week that systems of record either become AI harnesses or get replaced by the agents sitting on top of them.

Aaron Levie, CEO of Box.com, replied that governance, reliability, security, and access controls only get more critical when agents do 100x the work humans ever did.

Both are right. And between the two of them, they walked right past the layer that will decide whether any of this actually works: identity.

The Tan-Levie exchange, and the wave of quote-tweets that followed, kept circling the same question: who owns the harness? Do incumbent CRMs and ERPs bolt one on, or does a new generation of vendors ship them native? The debate is worth having. But every proposed answer quietly assumes something that is not, in most organizations today, actually true. It assumes the agent operating inside the harness has a real identity, the right permissions, the right guardrails, and an audit trail that survives the moment it acts.

Take that assumption away, and the harness is just an unsupervised script with API keys.

Every agent is a non-human identity, whether you plan for it or not.

The uncomfortable part of this shift is not "agents can do more." It is that agents are identities. They log in, they read, they write, they call APIs, they touch systems of record. And unlike the humans they act on behalf of, they:

• Never sleep, so they can do twenty-four hours of damage in the time it takes to file a ticket.

• Multiply faster than any HR roster. One workflow can spin up a dozen agent identities before anyone notices.

• Inherit authority from humans who may change roles, leave the org, or lose privileges the next morning.

• Leave audit trails only if you make them.

The rogue-agent scenarios that surfaced in replies to Garry's thread, scraping a system of record wholesale, cloning it, exfiltrating data at machine speed, all reduce to the same root cause. An identity nobody governed.

What identity has to do under the harness

If the harness is the part that decides and acts, identity is the part that decides who gets to decide. Five things stop being nice-to-have:

1. A real, revocable identity for every agent. Not a shared service account. Not a static API key pinned to a Slack channel. An identity with a lifecycle, an owner, and a kill switch.

2. Delegated authority, bounded by the human's authority. The agent should never have more permission than the person it acts for. If Alice can only grade her own courses, the agent she delegates to inherits the same fence.

3. Policy at the moment of action, not at the front door. API perimeter checks were designed for humans clicking buttons. Agents make thousands of small decisions per minute, each of which may or may not be permitted right now, in this context, for this data. Authorization has to move to the decision point.

4. Audit trails that survive the agent. When something goes sideways, "the agent did it" is not an answer. You need to know which human delegated, which policy allowed it, which data was touched, and whether the record can be trusted afterward.

5. A joiner-mover-leaver process for agents. Sponsor them. Renew them. Retire them. Treat the agent roster the way you treat the employee roster, because it is one.

Notice what is not in that list. None of it requires the underlying database to become probabilistic. Postgres, ACLs, and SQL stay deterministic, exactly like Garry called for. What gets smarter is the layer that answers a single question: should this actor be allowed to do this thing, right now, on behalf of that human?

A grounded example

Consider a Higher Ed scenario. A faculty member's assistant is a small agent that helps her respond to student emails, look up grades, and flag registration issues. Reasonable. Useful. Now ask the questions identity has to answer:

• Which faculty account delegated to this agent, and is she still faculty this term?

• Does she still teach the course whose grades the agent is trying to read?

• Is the registrar's grade-change window even open right now?

• If the agent proposes a change, does it route through a human approver, or does the record update silently?

• When she leaves the university in May, does the agent leave with her?

None of these are harness features. They are identity governance, doing its job underneath the harness. The system of record can stay boring. What has to earn trust is the identity fabric around it.

The layer that keeps the harness honest

The Tan-Levie framing is right that value moves toward whoever owns the layer that decides and acts. It moves faster when the identity layer underneath that decision is trustworthy, and it stalls entirely when it is not.

That is the layer we build at Jamf. RapidID gives each human, service, and agent a real identity, sponsors and retires them on the same lifecycle rails, delegates authority without breaking the fence, and hands off to policy engines that decide at the moment of action instead of at the perimeter. Boring plumbing, on purpose. It has to be, because the agents on top of it will not be.

Data is king. Access decides who rules. In the agentic era, the two of them govern together, or not at all.