The insider is synthetic. The vetting isn't.

Here is an uncomfortable observation. Microsoft confirmed this week that it treats its own AI models as insider risks – like any other badge-holder with keys to the building, and watched accordingly. Meanwhile, the manufacturing execution system at a plant I visited recently handed a single admin credential to an agent nobody had interviewed. We background-check forklift drivers. Medicals, certification, re-certification, the lot. Then we give write access to the quality management system to a model with no employment file and no manager to escalate to. Vendor doctrine is ahead of plant practice, and that gap closes one way: expensively.

What insider-risk doctrine actually says

Insider doctrine is boring on purpose. Least privilege, need-to-know, segregation of duties, monitoring for deviation from an established behavioural baseline, revocation measured in minutes rather than quarters. Perimeter defence assumes the threat is outside, climbing the fence. Insider doctrine assumes the threat already has a badge, a desk and a login – everything after that is bookkeeping about what the badge may touch.

The disclosure that put me in T-Mobile's public bug-bounty Hall of Fame was clickjacking – a trusted page element doing untrusted work. That is the original insider pattern, and it is how I frame every compromised agent: the same pattern at machine speed, holding your credentials, able to act rather than merely deceive. Thirty-plus security certifications, the Certified Ethical Hacker syllabus among them, teach the same lesson from a dozen angles. Most breaches are not a stranger at the door. They are something you already trusted, doing work you never assigned.

A badge is not a character reference – it is a key with a serial number, and serial numbers exist to be revoked.

The plant already runs this doctrine – for people

None of this should be new to a quality organisation, because we built most of it for humans. No operator closes their own 8D. No auditor approves the corrective action they audited. Sign-off authority is earned, tiered and logged. When I built the QA/QC department for a 900-plus-employee greenfield plant at SNOP, segregation of duties lived in the workflow engine, not in a policy memo – a nonconformance could not travel from detection to closure through one pair of hands. At WITTE Automotive the same discipline ran through 8D and control-plan changes: draft, review, approve, log. The failure-cost reductions we delivered there came from that structure, not from trusting people harder.

An agent that can close nonconformances, edit control plans and rewrite inspection instructions fails the most basic segregation-of-duties test – the one a trainee fails in week one. We would never let a person hold those powers jointly. We let the model do it because it arrived with an invoice instead of a CV.

Drift is the tell

Insiders are rarely caught by firewalls. They are caught by deviation from routine: the loyal analyst pulling ten years of records at 23:00, the plant login from a country with no plant in it. Behavioural baselines do that work, not perimeters.

Models drift the same way. A retrieval-augmented agent that was accurate in the pilot starts inventing part numbers after a document-store change; a prompt-injection payload turns a helpful summariser into a data pump. The controls map across cleanly: score outputs against a golden set every shift, quarantine on anomaly, require consensus before any write. The golden set need not be elegant – two hundred known-good records and their verdicts will do – but it has to run every shift, not when someone remembers it. I designed and built MultiPS, an orchestration platform that runs 63-plus models in parallel with consensus synthesis. That is deployment and integration work, not model training; the platform's job is to route, gate and adjudicate. Two independent models agreeing before an action touches the QMS is a synthetic two-person rule. It costs compute. A recall in this industry costs millions of euros and a quarter of your audit calendar. The arithmetic is not close.

The industry noticed the same week. Analysts started sizing an agentic-AI governance market, one platform vendor is issuing AI passports for its agent estate, and insurers are re-underwriting technology errors-and-omissions exposure around agents. Useful, all of it. But standards written at enterprise altitude still need plant-floor translation, and the translation is not exotic – it is access control, behavioural baselining and revocation, disciplines that have sat on our audit checklists for decades. None of that stops an agent holding one shared admin key. That is a plant problem, and it gets solved with architecture, not with frameworks.

Before the next agent goes live, demand three answers in writing: what it can write, who can revoke it and how fast, and which baseline will flag the day it starts behaving like a different employee. Microsoft's doctrine reads like a confession, but it is older than the models. Trust is a privilege granted in the smallest dose that keeps the process running, never a default. We have run plants on that principle for a century. The perimeter is gone. The badge is the control.