In security, friction is a GOOD thing. You want to have some ceremony to do things. It's pretty much inevitable that people will give up control for convenience.
Look at Artifacts for example.
Choosing how to sub-divide abilities, and allowing the user to manage that, will be an art unto itself, and depend largely on the system. Thinking a banking API with a rule like "Allow sub user to send payment to water utility once per month, not to exceed $200". The user only needs to intervene if something goes wrong and the amount goes over.
It is indeed a world of reality vs what sounds good on paper.
Problem is striking the right balance, and auto-forwarding your agent to foreign machines is not the right balance. At least not without being able to filter and approve individual signing requests.
It's true in the real world too which is why even in secure buildings a person can often slip in by coat-tailing someone. Stopping every single person to check ID is cumbersome and slows everyone down. People have stuff to do.
Truly high security environments are zero-tolerance, which makes them annoying and expensive to work in. I've talked to people who have worked in US military and CIA/NSA places and a very meaningful amount of time is spent complying with security and jumping through hoops. Even with all that, stuff gets leaked and stolen.
It's not just in computer security, it's in almost everything. People hate friction, but they need it make good decisions.
What we really need is smart people creating well-designed eusocial frictions, rather than trying to mindlessly eliminate friction from all areas. But guess which thing leads to products that can be sold more successfully on the market?
Oh boy, it isn't. Friction leads to frustration and therefore more likelihood to ignore the importance altogether.
The classic example is password rotation. It used to be standard to force users to rotate their passwords every 30/90 days, but that led to users having a sticky note on their monitor with their password on it, so security authorities no longer recommend this practice.
One more thing on balancing security and speed: I run regular audits and vulnerability checks, so I know the gaps are actually closed.
Sure, but in work, friction is not a good thing. So maybe security, if it involves friction, is not a good thing in work? Popularity of npm might be and evidence of that. Distribution system (along in its integration in a myriad of pojects) that's pretty insane from the security stanpoint contributed to so much great stuff and cooperation.