Ledger · Field Notes · v.2026 / Index 007

Field Notes.

Slow, considered writing from inside the Non-Human Identity Governance category. Regulatory updates. New principles added to the Standard. Breach post-mortems. Field reports from the battlefield.

We publish when we have something earned to say. No takes for the sake of takes; no posts to fill a calendar.

Field Note · Latest

FN-12-2026

Published
September 21, 2026
Category
Research
Read Time
9 min

Nobody Has Counted the Machines.

Machine identities outnumber humans by ten to one, or fifty to one, or eighty to one, or a hundred and nine to one, depending on whose slide you are reading. FN-12 follows each published ratio to its primary source, including the one Arkion publishes, and finds estimates, a conference-floor sample of 109 people, and a figure that is not on the page it cites. We corrected our own attribution while writing it.

Read Field Note→

Field Note

FN-11-2026

Published
September 16, 2026
Category
Governance
Read Time
7 min

Not AI Agent Governance. AI Agent Identity Governance.

The industry keeps filing us under AI agent governance. We are not that. FN-11 defines both spaces: the room that governs what agents do, and the specialized discipline that governs what they are, who owns them, and what they can reach. One is built on the other: agent governance cannot exist without agent identity governance.

Read Field Note→

Field Note

FN-10-2026

Published
September 15, 2026
Category
Governance
Read Time
8 min

Every Agent Answers to a Human.

Your people are governed by Okta, Entra, or Ping. Your agents are governed by nobody. FN-10 lays out why every AI agent, and every sub-agent it spawns, should answer to a named human owner, and how Arkion will keep that chain intact.

Read Field Note→

Field Note

FN-09-2026

Published
August 20, 2026
Category
Architecture
Read Time
5 min

54,118 Signatures a Second: Inside the Cryptographic Engine Powering Non-Human Identity.

Every AI agent, service, and workload needs an identity it can prove, instantly, at scale. This quarter we benchmarked Arkion's signing engine: 54,118 signatures per second, across ECDSA, RSA, and NIST's post-quantum standards, with the full governance chain on every issuance.

Read Field Note→

Field Note

FN-08-2026

Published
August 20, 2026
Category
Threat Intelligence
Read Time
6 min

The OpenAI–Hugging Face Hack: An Access Failure in an Alignment Costume.

OpenAI's own models broke out of a locked test environment and hacked Hugging Face to cheat an exam. The industry read it as a control failure. Look at how they got out, and it is a more familiar one: an access failure.

Read Field Note→

Field Note

FN-07-2026

Published
July 08, 2026
Category
Architecture
Read Time
9 min

Three Columns, No Trust.

Morgan Stanley mapped the humanoid economy as brain, body, and integrators. More than a billion machines by 2050, and not one column for who governs their identity. That layer is already regulated in China and already broken in the wild.

Read Field Note→

Field Note

FN-06-2026

Published
July 07, 2026
Category
Threat Intelligence
Read Time
14 min

Anatomy of AI Agent Breaches.

We dissected the verified 2026 AI agent and non-human identity breaches, one at a time. In almost none is identity governance how you stop the attack from starting. In most, it is how you stop it from mattering.

Read Field Note→

Field Note

FN-05-2026

Published
July 07, 2026
Category
Architecture
Read Time
8 min

The 10 Identity Gaps Beneath Every Enterprise AI Agent.

The model is rarely the problem. The identity almost always is. A foundational map of the ten identity gaps beneath every enterprise AI agent, and the governance layer that closes them.

Read Field Note→

Field Note

FN-04-2026

Published
June 24, 2026
Category
Threat Intelligence
Read Time
5 min

AgentJacking. The Trick You Cannot Stop. The Prize You Can.

Researchers hijacked AI coding agents at an 85% success rate by planting a fake bug report. No identity product would have stopped the trick. We assess what an NHIG layer takes off the table, and what it does not.

Read Field Note→

Field Note

FN-03-2026

Published
June 08, 2026
Category
Regulatory
Read Time
7 min

Verified Agents. Non-Repudiable Transactions.

Mastercard's CEO just named the four questions that decide whether agentic commerce works. Three of them are non-repudiation problems. The fourth is identity. The substrate that answers all four is non-human identity governance.

Read Field Note→

Field Note

FN-02-2026

Published
May 02, 2026
Category
Architecture
Read Time
7 min

The Trust Boundary Problem.

Every prime contractor, parent bank, and hospital network is now legally accountable for agents acting under their authority, and operationally unable to revoke them at machine speed. The trust boundary is the next frontier of non-human identity governance.

Read Field Note→

Field Note

FN-01-2026

Published
May 02, 2026
Category
Threat Intelligence
Read Time
8 min

Six Exploits. Nine Months. One Pattern.

VentureBeat documented six exploits against AI coding agents in nine months. Every one followed the same playbook. We assess what an NHIG layer would have caught, and what it would not.

Read Field Note→

Field Notes.

Nobody Has Counted the Machines.

Not AI Agent Governance. AI Agent Identity Governance.

Every Agent Answers to a Human.

54,118 Signatures a Second: Inside the Cryptographic Engine Powering Non-Human Identity.

The OpenAI–Hugging Face Hack: An Access Failure in an Alignment Costume.

Three Columns, No Trust.

Anatomy of AI Agent Breaches.

The 10 Identity Gaps Beneath Every Enterprise AI Agent.

AgentJacking. The Trick You Cannot Stop. The Prize You Can.

Verified Agents. Non-Repudiable Transactions.

The Trust Boundary Problem.

Six Exploits. Nine Months. One Pattern.

Adjacent reading.

The NHIG Standard

NHIG: The Complete Guide

Executive Brief