Security and identity

Target state

In short: Each agent gets its own short-lived, minimal-access account, and a rules engine it cannot bypass approves every action that matters.

IdentityAgent identity. A registered account for an agent with a named owner, limited permissions, and credentials that expire, so every action can be traced to who asked. is the perimeter. Every control in this layerLayer (the fourteen layers). One of fourteen parts of the enterprise estate that agents touch, from infrastructure (R01) to agent data engineering (R14). depends on the agent having a first-class identity of its own. Each agent holds a registered identity with a named ownerSponsor and owner. The sponsor is the business person accountable for why an agent exists. The owner is the technical person who keeps it configured and secure. and a risk tier. The identity is short-lived and follows least privilegeLeast privilege. Giving an agent only the access its current task needs, and taking it back when the task ends.: it carries only the access the current task needs. Shared human credentials do not exist. A small set of durable teammate agents may hold presence-grade capability: a mailbox, a meeting seat, or visibility in the directory. That is granted per capability surfaceCapability surface. Everything an agent can actually do: which systems it can read, write, send from, or appear in. Controls are chosen from this list, not from the product's name., the list of what the agent can actually do. It is granted only where the business sponsor accepts that the agent becomes discoverable and can be phished. All consequential actions pass a deterministicDeterministic. Always gives the same answer for the same input by following fixed rules. The opposite of probabilistic, where the answer can vary. policy decision pointPolicy decision point. The component that says yes or no to an action by checking rules against who is asking. The agent asks, the decision point decides, and the agent cannot skip it. (PDP): the component that says yes or no to each action by fixed rules. It sits in the path of every tool callTool. A function an agent can call to do something real: look up a record, send an email, run a query. Tools are where agents touch your systems., the moment an agent reaches into a real system, and the agent cannot bypass it. ProbabilisticProbabilistic. Produces a best guess that can vary from run to run. AI models are probabilistic, which is why their output informs decisions rather than making them in the four zones. detection, meaning signals that are best guesses rather than fixed rules, feeds the security operations centre (SOC)SOC (security operations centre). The team that watches for and responds to security incidents. through the security information and event management (SIEM)SIEM. The security team's central system for collecting and analysing security events. system. Agent-specific runbooks and new types of evidence come with it. GuardrailsGuardrail. A filter that uses an AI model to catch bad inputs or outputs. Useful as an early warning, but not reliable enough to be the thing that grants or denies an action., the AI-based content filters, run as an advisory layer and never as the boundary. In the four zonesDeterministic zone. One of four areas (access, money, safety actuation, formal records) where the final decision must come from fixed rules, never from a model. (access control, money movement, safety actuation, regulatory records) the decision itself stays deterministic: modelsModel. The AI engine that reads and writes text. On its own it has no access to your systems; everything built around it decides what it may do. may inform, never decide. This layer decides; the R03 gateway enforces what its identities and policies decide.

layer · architecture

The deterministic authorization chain

Every consequential action passes a policy decision point the agent cannot bypass; guardrails are an advisory side tap, never the boundary.

1. 01Agent

   Agent

   Agent identity

   Registered, least-privileged, short-lived, named owner and risk tier

2. 02Control

   Control

   JIT elevation

   RFC 9396 rich authorization; automatic drop-back

3. 03Control

   Control

   Policy decision point

   Cedar-class sub-millisecond or OPA; the agent cannot bypass it

4. 04System

   System

   Tool / action

5. 05Boundary

   Boundary

   Guardrails

   Advisory: measured evasion 72-77%

6. 06Control

   Control

   Information-flow control

   Deterministic; plus formal output verification where warranted

Fail closed when the policy engine fails; time-to-revoke is a measured metric.

Diagram description: Authorization chain from registered agent identity through just-in-time elevation and the gateway to a policy decision point and the tool, with guardrails as an advisory side channel and verification stages in parallel. The map contains Agent identity: Registered, least-privileged, short-lived, named owner and risk tier; JIT elevation: RFC 9396 rich authorization; automatic drop-back; Policy decision point: Cedar-class sub-millisecond or OPA; the agent cannot bypass it; Tool / action; Guardrails: Advisory: measured evasion 72-77%; Information-flow control: Deterministic; plus formal output verification where warranted. Its connections are identity to jit; jit to pdp; pdp to tool for allow, deny, limit, stop; guardrail to pdp for advisory signal only; ifc to tool for parallel verification. Important boundary: Fail closed when the policy engine fails; time-to-revoke is a measured metric.

Reviewed 2026-08-20·Sources:r10-security-and-identity findings

Mechanisms

The threat canon

In short: Four public documents now define how agents get attacked, and the weakest spots are what agents remember and how much people trust them.

Four documents define the mid-2026 threat model. The first is the Top 10 for Agentic Applications from the Open Worldwide Application Security Project (OWASP), released 9 December 2025. It runs from ASI01 (goal hijack) to ASI10 (rogue agents). Two of its entries reshape enterprise controls. ASI06 memory poisoning turns agent memoryAgent memory. What an agent keeps between tasks, from the current conversation up to long-term knowledge about customers or assets. The longer it is kept, the more privacy and retention duties it carries. into a way for an attacker to persist. ASI09 human-trust exploitation makes agent-to-human communication an attack surface. The second is MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems). It added fourteen agent-focused techniques in October 2025 and now stands at 16 tactics, 84 techniques, and 42 case studies. The third is Microsoft's failure-mode taxonomy v2.0 (June 2026). It counts 99 CVEs in 2025 alone that relate to the Model Context Protocol (MCP)MCP (Model Context Protocol). An open standard for connecting agents to tools and data, like a universal plug. An MCP gateway is the governed version of that plug., the open standard that plugs agents into tools. A CVE is a publicly catalogued vulnerability (Common Vulnerabilities and Exposures). The fourth is joint adoption guidance from six national cyber agencies (April to May 2026). It names five risk categories and gives two rules: start low-risk, and grant no broad access. The canon lands on an identity baseline. Non-human identities outnumber humans by roughly 100 to 1, and 97 percent of them hold more access than they need [vendor]. Only 23 percent of organisations have a formal agent identity strategy (Cloud Security Alliance and Oasis survey, January 2026 [sponsored]). In the same survey, 92 percent doubt that legacy identity and access management (IAM) can manage the risk.

Identity mechanics: JIT, RAR, revocation

In short: Each agent gets a named account, extra access only while a task needs it, and a tested way to revoke it.

Register every agent with a named owner and a risk tier, and remove shared credentials first. Least privilege for agents means just-in-time (JIT) elevationJust-in-time access. Access granted for a short window when it is needed, then withdrawn automatically. over a minimal baseline, with automatic drop-back. Standing permissions stay minimal. Extra access is granted per task, and it expires on its own. This was published as the least-privilege pattern for agents in July 2026 [vendor]. Authorising a single action uses OAuth Rich Authorization Requests (RAR, the internet standard RFC 9396). RAR puts the specific action's parameters inside the access token instead of granting a broad scope. Credentials are short-lived and cryptographically anchored, the term used by the US Cybersecurity and Infrastructure Security Agency (CISA) in its guidance. The US National Institute of Standards and Technology's National Cybersecurity Center of Excellence (NIST NCCoE) has a demonstration project dated February 2026. It composes OAuth, SPIFFEWorkload identity. Proof of who a piece of running software is, issued by the platform rather than typed in as a password. The machine equivalent of an ID badge., and MCP into exactly this chain. SPIFFE (Secure Production Identity Framework for Everyone) is the standard that gives running software its own proof of identity. The kill switchKill switch. A guaranteed way to stop an agent immediately, built at more than one point so that one failure cannot disable it. is an identity-platform feature, not an afterthought. Okta shipped one at general availability in April 2026 [vendor]. Time-to-revoke an agent credential is the metric that proves the switch works; drill it. The estate is ready: all four identity majors made agent identity generally available within twelve months [all vendor]. The dates are CyberArk November 2025, Okta April 2026, SailPoint May 2026, and Entra's agent registryAgent registry. The official list of agents: what each is for, who owns it, what it may touch, and which version is live. converging into Agent 365 in April 2026.

The policy decision point

In short: A rules engine the agent cannot skip approves or blocks each consequential action; if the engine is down, actions stop.

The authorisation boundary is policy-as-codePolicy-as-code. Rules written as versioned code that a computer evaluates the same way every time, reviewed and deployed like any software change. in the tool-call path: rules written as versioned code, evaluated by a PDP the agent cannot bypass. It is enforced at the R03 gatewayGateway. The single door every agent request passes through on its way to a tool or model. Because everything goes through it, it is where rules are enforced and activity is recorded., the single door every agent request passes through. Engine choice is a trade between properties. Cedar evaluates in under a millisecond and is formally verified, but it is stateless. Open Policy Agent (OPA) with its Rego language handles richer joins against external data. OpenFGA and SpiceDB cover relationship-based authorisation. Two deterministic complements shipped in 2025 and 2026. Microsoft's FIDES information-flow control, in Agent Framework v1.3, held the AgentDojo test to zero policy-violating prompt injectionsPrompt injection. An attack where instructions hidden in content the agent reads (an email, a web page, a document) trick it into doing something its user never asked for., against 20 to 152 without it [vendor]. A prompt injection is an instruction hidden in content the agent reads. Bedrock Automated Reasoning checks (GA 6 August 2025) verify outputs against formal logic [vendor]. The PDP fails closedDegraded mode. What a system does when a part fails. For agents, that means falling back to a human queue rather than guessing.: when the engine is down, consequential actions stop.

Guardrails are advisory

In short: AI-based filters miss most real attacks in published tests, so they may warn but never decide whether an action goes ahead.

Published measurement settles this. In one study (the LLMSEC 2025 workshop of the Association for Computational Linguistics, ACL), roughly 72 percent of attacks got past Azure Prompt Shield. Protect AI v1 let 77 percent through, and NeMo jailbreak detection let 72.5 percent through. In some configurations the figure rose to 100 percent. The one configuration measured at zero percent bypass paid for it with 16.22 percent false positives (legitimate requests wrongly blocked) and roughly 1.5 seconds of added latencyLatency. How long a request takes to come back. (arXiv 2605.06669). Latency alone separates the layers. A policy engine evaluates in under a millisecond to a few milliseconds. One large language model (LLM) guardrail call takes roughly 1.5 seconds. That is three orders of magnitude, roughly a thousand times slower. Guardrails are also themselves a target: an attacker can trip the guardrail on purpose to cause a denial of service (arXiv 2410.02916). The position this evidence forces: guardrails keep their value for content policy, detection of personal data (PII, personally identifiable information), and telemetryTelemetry. The stream of measurements a system emits about itself, collected centrally., where a miss is tolerable. They never authorise an action.

The mandate-bound payment stack

In short: The card networks now issue signed spending permissions that cap what an agent can buy, and the agent itself cannot alter them.

The card networks built the deterministic-boundary architecture independently. That is the strongest convergence evidence in this layer. Visa Trusted Agent Protocol (October 2025) uses issuer-anchored delegationToken exchange (on-behalf-of). Swapping one credential for another so an agent acts with the permissions of the person who asked, not with its own broader powers. tokens scoped by amount, merchant, and category. Mastercard Agent Pay (April 2025) uses agentic tokens bound to agent, merchant, and consent, revocable in real time. Google Agent Payments Protocol (AP2, September 2025, more than 60 partners) uses cryptographically signed mandatesMandate (payments). A signed, scoped permission to spend: how much, with whom, for what, until when. The payment network checks it, and the agent cannot change it. carrying hard constraints, in the World Wide Web Consortium (W3C) Verifiable Credential format. A mandate is a signed, scoped permission to spend: how much, with whom, for what, until when. All three are deterministic authorisation consuming probabilistic signals. The caveat this guide states plainly: the mandate does not protect intent formation. AP2 was red-teamed in January 2026 with prompt injection that operated inside the mandate's bounds. The gate bounds the blast radius. Defending against injection upstream, and having a human confirm intent, remain necessary.

The four zones, zone by zone

In short: For access, money, safety and official records, a model may advise but a fixed rule makes the final call.

Decisions in the four zones are made by deterministic rules over verifiable credentials and policies. Model outputs are advisory inputs (see deterministic zones). Three zones already run machine learning (ML) signals inside them, and that is the design, not a violation. Entra ID Protection feeds ML risk scores into deterministic Conditional Access. Mastercard Decision Intelligence scores every network transaction while authorisation stays rule-bound. Filings are drafted with AI and then attestedAttestation. A named person formally confirming that a record is true and taking responsibility for it. A model can draft; only a person can attest. under fixed rules: a person confirms the record, the model only drafts. Safety actuation is the one zone where standards exclude ML from the function itself. IEC 61511Safety instrumented system (SIS). Certified equipment that shuts a process down safely when limits are crossed. Standards exclude AI from it. is the International Electrotechnical Commission (IEC) standard for safety instrumented systems, the certified equipment that shuts a process down safely. It requires that the safety instrumented system not use AI. ISO/IEC TR 5469:2024, the technical report on AI and functional safety, frames AI outside the deterministic safety function. Records regimes mandate accountability and immutable records, not deterministic generation. The US Financial Industry Regulatory Authority (FINRA) confirmed in notice 24-09 (June 2024) that technology-neutral obligations continue to apply. FINRA 25-07 (April 2025) asks for comment rather than settling a new interpretation. The European Securities and Markets Authority (ESMA) said the equivalent in May 2024. Deloitte Australia's partial contract refund (roughly A$440,000, October 2025) is the cautionary case.

The structural finding

In short: A model cannot reliably tell instructions from data, so the protection has to sit outside the model.

Why the boundary must be architectural: a transformer treats every tokenToken. The unit AI usage is measured and billed in, roughly three-quarters of a word. (the small unit of text a model reads) the same way. It therefore cannot separate commands from data by training alone (Bhattarai and Vu, February 2026). Without mediation built into the architecture, authorisation holds only until someone discovers the next exploit. EchoLeak (CVE-2025-32711, severity 9.3 out of 10 on the Common Vulnerability Scoring System, CVSS) is the incident that shows it. It was zero-click exfiltration through a Copilot-attached mailbox, and the injected instructions were indistinguishable from content at the token level. Unit 42 has since documented indirect prompt injection in the wild. The design consequence runs through every mechanism above. Assume injection sometimes succeeds. Identity scoping, the PDP, and mandates exist to bound what a compromised agent can do.

Design decisions

• SIEM extension vs dedicated AI-security platforms (CD-13), a challenged defaultChallenged default. A technology choice most people treat as obvious, re-examined here against the simplest credible alternative on evidence and cost. about where agent security monitoring should live. The market is resolving toward platform absorption. There were six AI-security acquisitions in roughly fourteen months: Cisco/Robust Intelligence 2024; Palo Alto/Protect AI July 2025; SentinelOne/Prompt Security about $250 million; F5/CalypsoAI $180 million; CrowdStrike/Pangea about $260 million; and Check Point/Lakera about $300 million. Two non-human identity (NHI) deals came on top: Cisco/Astrix about $400 million and Cyera/Oasis about $1 billion. Buy accordingly, but absorption is not parity. Behavioural baselining of agents remains unsolved in mainstream SIEMs, and guardian agents persist as a distinct runtime category (Gartner: 10 to 15 percent of the agentic market by 2030). Independents differentiate on agent-graph posture and research depth.
• Standalone guardrail engines vs platform-native plus deterministic gates (CD-16), a challenged default about where content filters should run. Deterministic gates own the authorisation boundary. Guardrails are advisory wherever they run. Choose standalone guardrails for content policy and PII coverage across models, and platform-native where the platform already hosts the workload. Never let either authorise an action.

Cross-cutting concerns

Evidence and limits

The incident record has four entries. EchoLeak (CVE-2025-32711, CVSS 9.3) was zero-click exfiltration via a Copilot-attached mailbox. Microsoft's failure-mode taxonomy v2.0 (June 2026) counted 99 MCP-related CVEs for 2025. Unit 42 documented indirect prompt injection in the wild. Agent tooling has suffered supply-chain compromise. Several figures are vendor-published and carried as such. They are the non-human identity ratios (roughly 100 to 1, and 97 percent over-privileged), the Cloud Security Alliance and Oasis survey [sponsored], the identity-platform GA dates and the JIT pattern, the FIDES AgentDojo result, and Bedrock Automated Reasoning checks. Verified only to headline: the RSA Conference (RSAC) 2026 reporting on the baselining gap; the primary report could not be retrieved. Secondary-sourced: the exact publication date of the six-nation guidance. The FINRA 25-07 reading traces through a vendor blog and should be verified against finra.org before it carries weight. One refusal: the widely repeated count of agents registered on Microsoft's platform is an earnings self-report, and this page excludes it. The phrase "models may inform, never decide" is the authors' formulation of the zone principle; the payment stack is its convergent evidence, not a standard citing it. Re-verify quarterly: the AI-security acquisition ledger (the fastest-consolidating market in this guide), SIEM behavioural baselining (after RSAC 2027), the NCCoE project's published output, and the FINRA 25-07 disposition.

The research behind this page

• Security and identity findings
• Research brief
• Vendor landscape
• Sources