How agents drift from narrow, scoped tools into holding access nobody remembers approving — told through real incident patterns.