LeCun is right — and the same structural gap is in your identity stack

Yann LeCun has spent years making a pointed argument about the limits of large language models. It's worth taking seriously — not just for what it says about AI, but for what it implies about the infrastructure we build around it.

LeCun's core claim: truly reliable AI agents need a world model — an internal representation of how actions lead to consequences. LLMs are extraordinarily good at predicting the next token, but they don't naturally reason about what happens in the world after an action is taken. They can write a plan; they can't model whether it will work.

What's less often observed is that the same structural weakness exists in how we govern identity in agentic systems.

Generating a response is not predicting a consequence

A model can produce a coherent, contextually appropriate answer without any representation of what that answer will cause to happen next. For systems that only produce text, that's acceptable. For systems that take actions — call tools, modify databases, send communications — it's a structural risk.

An agent that acts without modeling consequences is an agent that cannot be reliably governed. LeCun says this about AI models. It is equally true about identity systems.

The same gap in identity

A user authenticates. Credentials are verified. Access is granted. Trust is assumed to hold for the duration of the session. Any subsequent action — by the user, or by an AI agent acting on their behalf — inherits that initial trust without re-evaluation.

That is, structurally, the same problem. The authentication event is the equivalent of generating a token: a point-in-time evaluation that produces a response — "authenticated" — without modeling what happens next as a consequence.

A world model for identity

For identity governance in agentic systems, the equivalent of LeCun's world model is a trust-propagation model: a formal representation of how trust evolves as an agent chain executes, hop by hop. That's the insight at the core of the Identity Living System — trust as a continuously evolving quantity, updated at every step and driving enforcement at every hop, not only at entry.

• Hop 0 — user authenticates. Trust 0.97. A known starting state, not just an "authenticated" flag.
• Hop 1 — first tool call. Risk class, scope and data volume are observed. Trust 0.91.
• Hop 2 — elevated data volume detected. Trust degrades to 0.84. Tracked, not yet blocked.
• Hop 3 — scope drift: an email tool is called when session intent was a CRM read. Trust 0.71.
• Hop 4 — a bulk send is requested. 0.71 is below the 0.82 threshold for a high-risk irreversible action. Blocked — because the model tracked the consequence of every prior hop.

The MCP dimension

Every MCP tool call is a causal intervention in the world. The agent isn't generating text about sending an email — it's sending the email. Current MCP authorization answers one question: does this agent have permission to call this tool class? That's the identity equivalent of next-token prediction — locally correct, blind to downstream consequences. The Identity Living System asks a different question at every call: given everything that has happened in this chain since authentication, and the risk class of this specific action, should this call proceed?

Trust is not a login event. It is a property of the entire execution chain. The architecture governing that chain should model consequences, not just credentials.

While we wait for AI systems to develop better world models, the infrastructure around them has to compensate. If an agent can't predict the consequences of its own actions, the governance layer must.

This thinking is built into Corpilus Shield and the Identity Living System — preparing for launch. Pre-register for early access.

We teach the architecture behind this, live, with our expert partner Avenue78.