Whose session is the agent using?
The best single artefact here for the question why is a graph better than a slide? The answer it produces is a computed difference a buyer can check, not an adjective they have to trust.
The question
An AI agent that browses the web and acts on what it finds has to run somewhere. Two options:
| Option A: the user's own browser | Option B: an isolated browser with a scoped identity |
|---|---|
| Inherits the user's live sessions, already past MFA (multi-factor authentication), plus their desktop, their network position, their extensions, their cookies. Nothing to set up. | Starts with nothing. Whatever it can reach, somebody had to grant it deliberately. |
Everyone can argue this in adjectives: “safer”, “more convenient”, “enterprise-grade”. Nobody wins those arguments, and nothing is checkable afterwards.
The graph's answer: reach is computed, not asserted
The graph replaces the adjective with a node type. AuthorizationClosure is the transitive union of everything a given identity can reach by following grants, including grants reached through other grants. Compute it for both options and subtract.
“What isolation changes” stops being a claim and becomes a closure difference: these assets are reachable in A and not in B. A buyer can check it against their own estate.
The shape of the graph
Node types. Reality · Twin · Asset (4) · Evidence (6) · Measure (4) · Fact (5) · Grant (2) · AuthorizationClosure (2) · BlastRadius (2) · Vulnerability (6) · Risk (13) · PreventiveControl (3) · DetectiveControl · Owner (7) · AcceptanceDecision (2)
Edge types. backed_by · observed_on · measured_by · grants · exposes · reaches · impairs · gives_rise_to · owned_by · protected_by · conditional_on · emits · accepted_by · underwritten_by · connected_to (the edge set)
The seven owners are the interesting count, and they climb the whole organisation: IT → CISO → CFO / COO / DPO (the data protection officer) → CEO → Board. Five altitudes, and the escalation between them is a property of the edges, not of a workflow rule. Nobody escalates anything. A risk arrives at the CFO because the path from it leads there and nobody below has accepted it.
Three risks of the mitigation
Thirteen risks, and three of them are risks created by isolation itself. This is the detail worth stealing.
A slide comparing two options never lists the harms of the option it is recommending, because a slide has a direction. A graph does not: a risk node arising from a control node is the same shape as any other risk node, so it gets drawn, gets an owner, and needs accepting. Honesty is not a discipline you have to remember here; it is what the structure produces if you do not go out of your way to suppress it.
What it teaches
- Reach is computed, not asserted. A table lists permissions; only a closure tells you what they reach.
- Escalation without an escalator. The board is reached by a path, not by somebody deciding to raise it.
- The mitigation is in the graph too, which is what stops a risk assessment from being a sales document.
- Every external claim carries a URL. The seven public sources are nodes, so “where did this come from?” is a traversal.
For an agent
When comparing two deployment options for an agent, do not compare adjectives. Compute the authorization closure of each (the transitive union of every grant reachable over assume-role, pass-role and wildcard edges) and report the difference. For an agent, the closure is the rating floor, not the nominal grant. And model the risks created by the mitigation as first-class risk nodes.