SaaS Identity Is the New Security Perimeter

This report argues that identity — including human users, non-human identities (service accounts, API keys, AI agents), OAuth-connected applications, and persistent tokens — is the primary control plane and attack surface in modern SaaS and AI environments; it outlines an "Identity Exposure Lifecycle" (creation, access granting, token persistence, integration expansion, monitoring gaps) and recommends identity-centric visibility, token scoping/lifetime limits, and enforcement to manage AI-related risk.