Observer or governor? Why your AI control plane needs identity-first controls

Your API gateway can tell you an agent made a call. Your directory can tell you the agent authenticated. Neither can tell you what the agent did once it was …