Okta moving from users to agents is the tell, because KYA will eat IAM once bots act, not just chat. Signed runs turn logs into a trust loop, which pulls SaaS into VTS. One stack, fewer UIs. Proofs beat prompts, so agent control planes win.