The institutional problem is not that employees bypassed procurement; that was the old shadow IT script. The new break is that agent systems can chain tools, invoke connectors, and act across company surfaces after a single user has granted access. That makes governance less like software approval and more like access mapping under live motion. When one post points to MCP connectors as a risk-mitigation topic [4], it captures the real control surface: the connector graph is where enterprise authority now leaks.