Most authentication systems solve the wrong problem. They verify identity at login — "are you who you say you are?" — then trust every action that follows. That worked fine when humans were the only ones taking actions.
It breaks down fast when AI agents are involved. The gap nobody talks about An agent logs in with valid credentials. It has a valid session. It makes a request to transfer $50,00