Why static IAM falls short for AI agents, and how runtime-scoped, ephemeral credentials reduce risk and misconfigurations.