.png)
I come from a technical background, and debugging taught me one discipline that never fails: isolate the variable. Hold everything else constant and find the single factor driving the outcome. AI security needs that discipline now.
The core problem with securing AI agents is that most security systems only evaluate one part of the interaction at a time, while agent attacks often unfold across the full chain of behavior.
Many companies already have multiple layers of security in place: posture tools to inventory models and agents, gateways to inspect tool calls, DLP systems monitoring sensitive data movement, and detection platforms looking for abnormal agent behavior.
Individually, these systems can work exactly as intended. A posture platform may confirm that an agent was approved and properly configured. A gateway may validate that a tool call complies with policy. A DLP system may allow data movement because the agent legitimately has access to that data. A detection platform may eventually identify suspicious behavior patterns.
The issue is that none of these systems necessarily understands the broader context of what the agent is actually trying to do across the entire interaction. As a result, an attack can move successfully through multiple security layers without any single system identifying the full sequence as malicious until after the action has already happened.
The Industry Has Run This Race Twice Already
Rewind to early 2023. ChatGPT had just put generative AI in front of every enterprise, and within months dozens of vendors were selling “LLM security.” The job back then was to protect the model and to stop employees from pasting secrets, source code, and customer PII into a chat window. That was the entire threat model, because that was the entire product surface.
Then the surface moved. Eighteen months ago, “AI agent” barely had a definition. Today agents call tools, chain actions, and reach across systems on their own, and a new crop of vendors has arrived to secure them. Right now, with agents in production, a third wave is forming around AI runtime security - watching what these systems actually do once they are live.
The pattern is hard to miss. Each wave is a point solution built for whatever AI had just become, shipped right as AI became something else. And nearly all of these tools do the same thing: they watch. They discover, they scan, they score, they alert. Very few sit on the request path with the authority to stop anything.
This is the trap enterprises are walking into. You cannot secure AI one capability at a time, because the capability keeps changing faster than the tooling can harden around it. An industry that ships a product per wave stays permanently one wave behind the actor it is trying to contain. When the ground moves this fast, the only thing worth building on is the part that does not move.
Every AI actor runs on an identity.
Strip away whichever wave you happen to be in - chat, agent, whatever comes next - and the same question sits underneath all of them: what can this thing actually reach?
Every AI actor runs on an identity. A service account, a machine identity, an OAuth grant. And that identity carries access across the organization that simply sits there. Scope the token all you want at issuance; underneath it is an identity with standing entitlements the actor inherits and keeps. For the life of the task, and usually well beyond it, that access is just present. Waiting.
That is the root cause. Not the prompt injection, not the tool description, not the model. Those are entry points, and entry points are interchangeable. What turns a compromised agent into a breach is the standing access waiting on the identity it runs on. Give an attacker an agent with a valid token and broad standing entitlements, and they do not need an exploit chain - they have everything they need the moment they are in. We have made this case before: standing privilege is the real story behind every major breach. Agents do not rewrite that story. They run it faster.
This is why the fully loaded stack still fails. Discovery, gateways, DLP, detection - not one of them takes the standing access away. They inventory it, check it at the door, scan it, and alert on it. The access is still sitting there the entire time, and watching an exposure is not the same as removing it.
Isolate the Variable
The attack vector will always change - prompt injection today, something else next year - but the access on the other side is what decides whether any of them becomes a breach. And whatever form AI takes, it will always reach for data. Those are the constants, and both of them resolve at the access layer.
So the durable control is simple to state. If an AI actor holds no standing privileges and no standing access - if every grant is just-in-time, ephemeral, monitored while it is live, revoked when the task ends, and audited afterward - then it is wrapped in guardrails that do not depend on what it is. The access exists only for the request and is gone after, leaving nothing standing for an attacker to inherit.
This is not a new category of AI security product. It is identity and access doing what it has always done - deciding what an actor can touch - for an actor that moves faster than any before it. You close the gap not with richer gateway policies or smarter monitoring, but by running the full cycle as one decision on the request path: discover the actor the moment it appears, provision its access just-in-time against real business context, evaluate behavior continuously, and revoke the instant something turns.
The Layer That Was Always There
We have argued that thirty years of privileged identity is about to change because agents broke the architecture. This is the other side of that argument, and the identity providers already see it coming. Entra ID has shipped AI identities. Okta is rolling out agent identities. The largest IdPs in the market are quietly making agents first-class citizens of the same identity model they have run for humans and service accounts for twenty years. If that is where agents are being absorbed, that is where the control over their access has to live.
In practice, that control is a harness. Something that wraps the agent, or the chat, across its whole working life. It sees the actor, knows what it is supposed to do, lets it do that and only that, and closes the door the moment its behavior drifts - leaving no standing access waiting behind it. Not a new tool to sit beside the others, but the next generation of identity and access, doing the job it has always done against an actor it has never seen.
The One Thing to Take From This
When you evaluate anything sold as "AI agent security," do not ask which slice of this moment it covers, because the moment will move. Ask whether it lives in the access layer, whether it can remove standing access instead of just watching it, and whether it will still be doing its job two waves of AI from now. Every prior shift in computing eventually produced one new layer of access discipline that absorbed the new world - networks went through it, cloud went through it, and agentic AI is producing its candidates now. The one that wins will not be built for this quarter's version of AI - it will be the one that puts a harness on every AI actor in the environment, runs the whole loop in the access layer, and leaves nothing standing behind.
