Visibility was the first battle. We built dashboards, access reviews, and certification workflows. We learned to see our identity landscape.

But seeing isn't knowing.

Knowing means understanding what identities are actually doing inside your applications, not what policies say should happen, but what executes. In the agentic era, that distinction is no longer academic. Agents are acting at machine speed, on stale permissions, without an owner or trace. Visibility can't catch that. Observability can.

This session explores the frontier between seeing and knowing and why closing it is identity security's next imperative.