My goodness, the security layer looks like it could be more complex than the applications themselves.

And if this security agent is wandering around the IT system gathering all of these details about access and identity and business process, who watches the watcher? How does that thing build and maintain trust?