Who gets the keys to the agent? Banks say no, labs say "trust us," governments want it in writing.

identity-security TAM, Morgan Stanley

Marshall estimates AI agents could more than double the identity-security market in two years — the number inside Friar's "big driver" line. Source

Four of today's five stories answer the same question from different seats: who authorizes an agent to act. A bank says no one from outside. A frontier lab finds the breach was a human with a USB stick. A government signs a bilateral disclosure protocol. A CFO sells the solution. The agentic commerce roadmap of the last twelve months assumed account access would be granted on the agent's technical merits; this week it's being granted — or refused — on counterparty risk, insider risk, and sovereign risk, in that order. The next twelve months of agent GMV will track bank policy and government MOUs, not benchmark scores. Considered and passed: Walmart's Sparky-in-ChatGPT handoff (reheated October-2025 news with a Shopify twist, not today's thesis) and the Alibaba AI Glasses N1 launch (hardware-margin story, no agent capability disclosure).

— Agentic desk