Let’s talk about the week the machine got a kill switch and you got a free credit check.
On the eleventh, two security vendors shipped products that do roughly the same job. Orchid Security announced identity drift detection and application-level kill switches for AI agents. Akeyless announced general availability of something called Agentic Runtime Authority — a real-time control layer that restricts what an agent is allowed to do after it already has access, on top of a credential layer built so the agent never holds the keys itself.
Sit with what those two sentences are actually describing. A software worker gets an identity. It gets a scope of authority, defined in advance. It gets watched while it works, and a human can switch it off in the middle of a task without breaking anything else.
Now the other story.
On 4 September, IDScan.net — a Louisiana company that verifies government IDs for car rental counters, retailers, and more than nineteen hundred cannabis dispensaries — posted a notice on its own website. On or around the first of the month, someone had got into its cloud platform.
The number attached to that intrusion is 153 million. That’s how many scanned driver’s licences from the United States and Canada appeared for sale on a dark web service called Nexus. Ten million ID cards on top of that. Three million travel documents. Five hundred and seventy-nine thousand medical cards.
Journalist Brian Krebs authenticated it by finding his own Virginia licence offered up as a free sample. He traced the data back to IDScan. The FBI’s New Orleans field office opened an investigation, and the seller’s storefront disappeared not long after the story published.
Here’s the detail I keep coming back to. IDScan posted that breach notice with a directive telling search engines not to index the page. The disclosure existed. It was engineered so nobody would find it.
So we have both halves now, side by side, in the same week.
The agent gets credentials that are short-lived, narrowly scoped, bound to the human or organisation that authorised the work, revocable mid-session, and wrapped in an audit log of what it did and under whose authority. That isn’t vendor marketing — it’s the design pattern showing up across the actual standards work. The IETF drafts doing the real identity and authorisation work here live in the WIMSE group, not the flashier discovery effort everyone quotes, and they converge on the same shape: separate the agent’s own identity from the authority it acts under, then time-box and scope everything down. Microsoft shipped Agent 365 in May. Okta shipped agent identity in April. The industry has decided machines deserve revocable identities.
The human gets a number.
One number. Printed on a card. Issued once, valid for years, accepted as proof of who you are at every counter, bank, landlord, clinic and border you will ever walk through. And when it leaks, you get twelve months of credit monitoring and a sentence about an abundance of caution.
You can’t rotate a driver’s licence number. You can’t revoke it. You can’t scope it so the car rental company learns you’re old enough to drive and never learns your home address. You can’t even find out who is holding a copy of it, because the moment you handed it to the person behind the counter, the copy stopped being yours.
That asymmetry is the story. Not the breach. The breach is just the receipt.
And the breach is not a security failure in the way we usually mean it either. IDScan wasn’t careless in some exotic way. It was doing precisely what the whole verification economy demands: collect the full document, keep the full document, hold it in a central place that every customer can query against. To prove you are real, you have been trained for two decades to hand a complete copy of your identity to a stranger holding a tablet. Every one of those strangers is running an archive.
Do the arithmetic on that. Multiply one scan by every hotel check-in, every vape shop ID check, every car hire, every parcel collection, every age-gate you have ever passed. You don’t end up with a database. You end up with a distributed, unmanaged, permanently retained image archive of the population’s identity documents, sitting on the cloud infrastructure of companies nobody has heard of, protected by the security budget of a mid-sized vendor.
That’s what people are missing. The verification company is not a victim of the honeypot. The verification company is the honeypot — it is the single richest concentration of identity proof in the market, and it accumulates precisely because we route every trust decision through a copy of the original.
Here’s the part that matters for anyone building. The industry has already invented the answer for its machines and refuses to use it for people. A driver’s licence answers exactly four questions: is this person who they claim to be, are they old enough, is the document valid, does the photo match. That’s an answer. That’s what the counter actually needs. What we hand over instead is a full scan — the number, the address, the date of birth, the signature, the photo, sometimes the organ-donor flag — most of which nobody in the transaction has a legitimate need to keep.
Verifiable credentials flip that. The verifier gets a signed answer to a specific question, and nothing to keep. The claim travels. The document doesn’t. If the middleman’s vault is emptied tomorrow, it contains nothing worth selling, because it never held the proof in the first place. That’s what proof without surrender actually looks like at a counter. Not a slogan about decentralised identity. Just a check that returns “yes, over twenty-one, valid” instead of a picture of your home address.
The operator lesson is blunt. If your product collects identity documents, you are running a liability with a login page, and you should be able to name the exact question you need answered for every field you store. If you can’t, delete the field. If you’re building the verification layer, the honest pitch is not better security on the same archive — it is that the archive stops existing. And if you’re just a person in the queue, the thing to demand is the same pattern the industry is already designing for its agents: scope it, time-box it, make it revocable, and log who used it.
Short-lived credentials. Narrow scope. Revocation. Audit trail.
That’s the standard we now accept as the bare minimum for a chatbot booking a table.
Fifteen years of scanning a document to prove you exist produced an archive of a hundred and fifty-three million of them. There is a version of this that doesn’t need the archive, and it isn’t exotic — the cryptography has been sitting there for years. We’ve just been selling it to machines first. You’ve got this. You just shouldn’t have to prove it with the originals.