Foundation → Enterprise → Advanced: Is the Agent Access-Control Jump a Cliff?

No cliff — Enterprise (ABAC + dynamic privilege elevation with return-to-baseline + mTLS + sandboxing) is the pragmatic midpoint between Foundation static roles and Advanced JIT/JEA; migration runs identity-first, then least-agency, then blast-radius