“Traditional identity security controls are ineffective for autonomous AI agents because users need to grant them broad permissions to be useful.”