How teams actually control what AI agents can access

A researched map of the real tools behind "agent permissions": policy engines, non-human identity platforms, MCP's own OAuth flow, and cloud IAM for agents, four different layers people keep treating as one.