An agent is not a user with an odd-looking address
Modelling a non-human caller as a person who never sleeps produces tokens and nothing else. You cannot report on them, revoke them as a set, or find them in a directory, because "agent" was a naming convention and not a type.
The migration nobody budgets for
An identity provider migration is quoted as an identity project and delivered as an application project. That is why the estimate is always wrong, and why the second one is worse than the first.
Your role model is a tree. Your company is not.
Two failures, in a fixed order: the hierarchy cannot express a role with two parents, and then the grant that actually matters turns out to be a slice rather than a role. The second one is how authorization ends up in application code.