This is an identity-and-access-management proposal for AI agents, dressed up as management advice. The diagnosis: the middle tier of AI adopters has handed every employee a "slop cannon" — big token budgets, no identity model, API keys copied into every .env in the company — producing duplicated effort and key sprawl nobody can audit. The fix it argues for: give each agent its own principal, treat it as a direct report of its user, never with more access than the owner, usually less. Concretely that means short-lived signed tokens, actions attributed to the agent, and a chain of custody for who created it. The second half generalizes to agent-built apps: promote them personal → team → org, each level getting its own principal and keys, with "seeing an app ≠ having its access" as the invariant. Architecture-wise it sketches no-network sandboxes, a gateway that attaches secrets from an allowlist and strips them from responses, and an append-only grant ledger where delegation can narrow but never widen, so revoking a parent kills everything below it. The "Astra wrote the core in 15 minutes" line is assertion, not demonstration. The sharp open question: companies that never set up identity for humans are exactly the ones who'd need this most — who builds the gateway there?