Your over-permissioned users are your over-permissioned agents
When an agent acts on behalf of a user it inherits that user's access, so your half-governed pile of human permissions becomes agent attack surface. Why agent blast radius starts upstream, with people, and how to right-size both sides of the identity ledger.