Somewhere in your stack there is an agent that can still write to the client folder. The project shipped in March. Nobody remembers the grant, because remembering is not anyone's job.
Here is the mechanism, and it is an asymmetry of deadlines before it is anything else. A permission gets granted at the moment of maximum urgency. The task is blocked, the approval is the blocker, and the person approving is usually the person waiting. So the grant is fast and generous — read the whole drive, not this folder for this week — because a narrow scope takes longer to write than a broad one, and the deadline is now. Revocation has no such moment. Nothing breaks when a stale grant survives. No one is waiting on it. Granting has a deadline. Revoking has a someday.
Run that asymmetry for a year and the arithmetic does the rest. Grants are additive. Tasks are transient. The permission set only grows, so by autumn an agent's access describes its history, not its job. Ask what it is doing and you get a clean answer. Ask what it could do and the honest answer is an archaeology project.
This is not a rogue-agent story. Every grant in the drawer was reasonable on the day it was made. That is exactly what makes the drawer dangerous. It is a pile of individually sensible decisions that nobody has ever read as a sum — and the sum is your actual exposure, because an agent's reach on its worst day is the union of everything it can touch, not the task it happens to be on.
The industry has started to notice. The review side of this problem is beginning to ship as a real admin surface: a consolidated place where a human can list every agent, read what each one is allowed to reach, and switch one off. That is the right instinct. A drawer you can open is the precondition for a drawer you can clean.
Yesterday I argued that work moving between agents should carry a note saying what was checked and what was not. Authority needs the same paperwork travelling the other direction. Not just what the agent produced, but what it was allowed to reach while producing it.
The move costs one afternoon. List your agents. Next to each, two columns: what it can currently touch, and what its current job requires. The gap between the columns is your accumulated risk, and most of it closes with deletions nobody will notice. Then change the default going forward. New grants get an expiry stamped at creation, sized to the task. Renewal stays cheap — a request and a yes. Permanence becomes the thing that needs a justification, because right now it is the thing you get for free.
Takeaway: Access granted under deadline and reviewed never will grow until it describes the agent's past instead of its job. Put an end date on the grant, keep renewal cheap, and the drawer stays legible. ✱
