TUTORIAL

A 24/7 AI agent is a long-lived identity holding credentials. Three September 2026 incidents show the blast radius was always knowable in advance — the fix is an inventory, not a better prompt.

A specification sheet describes what a machine was allocated, not how much of it you receive during your busiest hour. On shared infrastructure that quantity varies with tenants you will never know about.

SMS pumping turns a legitimate OTP flow into someone else's revenue without breaching anything. No credential is stolen, no alarm fires - the only symptom is a messaging bill growing faster than the business.

Deploying a 24/7 agent takes minutes; keeping one alive is a different discipline. Memory, context, and unsupervised drift accumulate slowly, report misleadingly, and none of them come from the model.

A snapshot rolls back a change you planned. A backup recovers from a failure you did not. If one credential can reach both your production system and your recovery copy, you have a speed bump, not a control.

Bandwidth planning fails when it is framed as a volume question. Every plan states a transfer allowance and hides a port speed - and the port is what limits how many users you can serve.