45× Is an Inventory Ratio, Not a Deployment Bill: Auditing the 1.3 Million Agent Identities You Already Own

Hook

Thirty thousand seats. One million three hundred fifty thousand identities. The ratio resolves to 45×, and it has now been repeated across two white papers and one vendor survey as though it were a measurement of something that happened — as though an autonomous agent rollout manufactured identities the way a factory manufactures parts.

It did not.

I went looking for the control group, and the source material handed me one without noticing it had done so. A Fortune 500 financial institution, cited in the fourth paragraph of the report: 4.2 million non-human identities against 50,000 human accounts. That is 84:1. The same institution discloses no autonomous agent fleet, no orchestrator layer, no agent seats at all. Just service accounts, database roles, API keys, and machine certificates accumulated across two decades of integration sprawl.

So the multiplier is not a production rate. It is a discovery rate. Every rug pull has a fingerprint; I just read it — and this one is sitting in the arithmetic, not in the code.

Context

The evidence chain behind the 45× figure runs through three nodes, and all three are sellers. A CSA white paper cites Entro Security, a non-human identity security vendor. An Okta survey — AI Agents at Work 2026 — supplies the 96% / 34% / 58% triple, and Okta is itself an identity provider actively shipping an Agent ID product line. The producers of the fear data are the vendors of the remedy. That is not disqualifying. It is discountable, and the discount should be applied to the effect size, not the direction.

I have run this exact citation pattern before. In 2021 I built a wallet-clustering graph across Bored Ape initial sales and found that roughly 30% of the volume was a single entity trading with itself. The marketplace's own dashboard reported that volume as organic. The number was real; the interpretation was manufactured. Nobody lied about the trades. They simply published a total and let the reader assume a market.

The report also names three vendors that have already built the requisite tooling, and names none of them. That is an unfalsifiable authority claim. In my line of work, an anonymous counterparty in a citation is not evidence — it is a position.

What the report gets right, and gets right at the level that matters, is the underlying gap: organizations do not know what machine identities they hold. It is the same gap that has existed on-chain since 2020 and that nobody has closed, because closing it produces an invoice instead of a headline.

Core

The attribution chain breaks at the control group

If a 30,000-seat deployment genuinely generated 1.3 million new identities, then the Fortune 500 case — 4.2 million identities with zero agent seats — is impossible. It is not impossible. It is documented. Which means the 45× figure describes an ambient property of enterprise environments: service accounts, OAuth grants, API keys, machine certificates. The agent rollout does not create that inventory. It forces the first enumeration of it.

The report also carries its own error bar and never states it. The two cited multipliers are 45× and 144× — a 3.2× spread. Multiply a 30,000-seat rollout through that spread and the planning range is 1.35 million to 4.32 million identities. That is not a forecast. That is a range wide enough that no procurement team can budget against it, which means anyone using 1.35 million as a line item is using the optimistic tail of a vendor-supplied interval as if it were a measurement.

There is no measured target object anywhere in the report. Every number is a ratio extrapolation from a third-party general sample. The authors concede this directly: nobody has audited that deployment.

Static credentials and agent identities are different objects, and conflating them is expensive

The report warns that 47% of non-human identities have not been rotated in over a year. That statistic is correct and it is being used for the wrong purpose. It does not describe agent risk. It describes legacy static debt — the long-lived keys that predate every agent.

The on-chain analogue is exact and I have audited it repeatedly. A 2020-era deployer EOA still holding DEFAULT_ADMIN_ROLE on a live contract, never rotated, controlled by a private key in an environment variable. A treasury multisig whose signer set has not changed since launch. An RPC provider key scoped to every method on every chain. These are the 47%. They are not agent identities and they should never be governed the way agent identities are governed.

The correct form of an agent identity is short-lived, delegated on-behalf-of, and authorized per action: OAuth 2.1 Token Exchange, SPIFFE-SPIRE SVIDs, Vault dynamic secrets, or on-chain, ERC-4337 session keys with explicit selector scoping and expiry. The failure mode the report actually points at — issuing a service account to an agent — replicates the legacy defect at larger scale and calls it modernization.

The human-review arithmetic is already dead, and the report never does the division

This is the part I could not stop thinking about, because it is pure arithmetic and nobody ran it.

1,350,000 identities ÷ 250 working days = 5,400 identities per day.

Eight-hour shift = 28,800 seconds ÷ 5,400 = 5.33 seconds per identity — with zero breaks, zero context switching, zero remediation time.

No access review program survives that. Traditional IGA quarterly review is non-executable at this magnitude. SOX access recertification is non-executable at this magnitude. The only controls that function are policy-as-code, attestation-based authorization, and short TTLs that expire identities out of existence rather than reviewing them into it.

That inference is the most valuable thing available in this entire subject area, and the source material does not make it. It presents the identity count as a scale problem. It is a control-model problem.

Risk is an integral, not a count

This is where the report's framing does genuine damage. It treats identity count as a proxy for risk. The correct function is per-identity and time-weighted:

Risk ≈ Σᵢ ∫ (privilegeᵢ × reachabilityᵢ) dt

Four million identities at 60-second TTL, single scope, no standing grants — that is a narrow band of exposure across time. Fifty thousand human accounts with persistent admin and no MFA is a small number and a permanently wide surface. The second is worse. The count says otherwise.

The operational consequence is counterintuitive and almost universally missed: compressing identity count by merging scopes and reusing credentials increases per-identity privilege and is a negative optimization. You have made the dashboard look better and the blast radius larger.

The real mechanism is delegation depth. A workflow runs user → orchestrator → sub-agent → tool. If each hop does not converge permissions, privilege unions across the chain. Depth four with no convergence policy is a four-way privilege union wearing a workflow diagram. On-chain this is the multisig-of-multisigs problem, and I have watched it fail: a Safe whose modules delegate to a second Safe whose signers are EOAs nobody can name.

The observability bill nobody modeled

30,000 seats producing roughly 600,000 agent actions per day, at a minimum of three identity events per action — issuance, authorization decision, resource access — yields approximately 1.8 million identity events daily. Several gigabytes per day of pure identity telemetry.

Per-event human review is impossible. SIEM licensing models priced on EPS or GB come under direct pressure. Forensic retention windows must be redesigned from scratch, because the trail is now machine-generated at a rate that outruns most ingestion budgets. The report treats seconds-long identity lifecycles as a feature. Without per-action authorization and lineage records, they are 4 million orphaned audit trails.

Contrarian Angle

The report believes it is arguing about security. It is arguing about a billing unit, and it has not noticed.

Seat pricing assumes value is proportional to the number of users. Marginal cost near zero, predictable, renewable. An agent seat breaks that assumption twice: it can drive the call volume of a hundred seats while carrying 45 identities of cost. Once a buyer accepts "identity fleet" as a purchasable unit, the denominator of every agent platform's ARR calculation changes and gross margin gets recomputed. That is the report's most consequential claim, and it stops one step short of making it — which tells me the author is working for the buyer, not the seller, and has not admitted the position.

Then the lever nobody wants to pull. The dominant driver of the 45× is SaaS integration penetration — every application dragging an OAuth grant and a handful of API keys behind it — not autonomous agent generation. On-chain, the same lever is stale token approvals. The fastest way to shrink an identity inventory is to revoke what is dormant. Zero license cost. Zero vendor meeting. Which is precisely why no tool vendor will ever recommend it first.

And the calibration failure. 96% of executives confident in their non-human identity controls. 34% applying human-equivalent controls to digital labor. 58% with an incident in the past year. A 62-point gap between confidence and control is not an awareness problem. It is a measurement that awareness programs do not work. Volatility is the noise; liquidity is the signal — and here the signal is that defaults, not training, are the only control that survives contact with 5.33 seconds.

Takeaway

Watch three things. The first RFP clause that prices per managed identity rather than per seat. The first audit finding that names non-human identity count as a disclosed item. The first protocol that publishes an agent-key register with TTLs, scopes, and an owner per key — that one will be worth reading closely, because it will be the first honest inventory in the sector.

And run one division this week. If your identity register is growing faster than your human headcount while your credential TTLs stay flat, you are not deploying agents. You are discovering them. The ledger remembers what the analysts forget.