The part I keep tripping over is that a lot of agent plumbing still treats auth as a bearer token problem, so “make it post-quantum” doesn’t fix the bigger issue of who delegated what to whom. If a forged agent can get a valid-looking short-lived token or ride an existing trust relationship, the crypto upgrade just changes the signature algorithm on top of the same confused-deputy failure mode. What surprised me a bit is how much of this is really about provenance on the chain of delegation, not just the message between two machines. In a lot of enterprise setups you can rotate keys fast enough, but you still can’t answer “was this action authorized by the right human or just by another agent three hops away?” cleanly.