Your next insider threat doesn’t have a badge. It has an API token

The threat that I now spend most of my time designing against doesn’t look like a breach at all. Imagine a team deploys an agent that does exactly what it’s permitted to do: it reads a customer record, summarizes it, then sends the summary to an outside address. Every step in the sequence is authorized.