4 standards solve agent identity. None solves the harder question: Is it still the agent you approved?

I’ve stopped being surprised by the service account nobody can explain. It was created for a migration that finished years ago. Whoever requested it left before anyone wrote down why.