Article reader Listen + reading controls
Article reader
Preparing the reader…
Reading settings
Agent security starts before the agent acts¶
The National Institute of Standards and Technology (NIST) has opened a request for information on securing artificial intelligence agent systems. The timing is right. Organizations are moving from systems that generate suggestions toward systems that can call tools, manipulate records, send messages, and coordinate multi-step work.
The security question is no longer only what a model might say. It is what the complete system is allowed to do—and whether the organization can reconstruct what happened afterward.
An agent is an actor inside an institution¶
An artificial intelligence (AI) agent operates through permissions that an organization gives it. It may inherit a user's access, receive a service identity, or move among several tools with different controls. Each design creates a jurisdiction: a bounded area in which the agent can observe, decide, and act.
That jurisdiction is often less legible than it appears. A read-only research task can become an action task when the agent follows a link into an authenticated system. A calendar assistant can expose sensitive context through invitations. A coding agent can change dependencies, tests, infrastructure, and documentation in a single run. Tool chains make small permissions composable.
Security therefore has to begin with an explicit model of authority. Which resources can the agent reach? Which actions require approval? Which conditions suspend access? What evidence is retained? Who can stop the system when its behavior is technically valid but operationally wrong?
Traditional controls still matter, but the seams change¶
Least privilege, separation of duties, strong identity, logging, and incident response remain sound principles. Agents make their application more dynamic.
The National Institute of Standards and Technology's zero-trust architecture rejects implicit trust based on network location. Agent systems need the same discipline at the action level. A successful authentication should not become indefinite permission to pursue an evolving objective. Authority should be specific to task, resource, time, and consequence.
The harder failures occur at handoffs. The model proposes an action, an orchestration layer translates it, a connector invokes an application programming interface (API), and a downstream system records the result. Each component may behave as designed while the combined outcome violates the user's intent. Logs that capture only the final API call omit the context needed to understand the failure.
Design the audit story before deployment¶
A useful test is to imagine the review after an unexpected action. Can the team answer:
- What objective was the agent pursuing?
- Which instructions and data shaped its decision?
- Which identity and permissions authorized the action?
- Where did a human approve, redirect, or fail to intervene?
- What changed in the environment as a result?
- How can the action be contained, reversed, or learned from?
If those answers depend on several teams manually assembling incompatible logs, the system does not yet have an adequate audit story.
The work is organizational as much as technical. Security teams define threats and controls. Product teams define intended behavior. Domain experts recognize when an action violates practice. Platform engineers understand the tool chain. Operations teams manage recovery. The architecture has to preserve enough common context for those groups to investigate together.
NIST's request is an opportunity to shape shared practices while the technology is still malleable. Individual organizations should not wait for consensus. They can inventory agent identities, define action classes, require human approval for irreversible or high-impact steps, capture end-to-end traces, and rehearse failure with the same seriousness used for other privileged systems.
The safest agent is not one that never acts. It is one whose freedom is deliberately bounded, whose consequential actions are visible, and whose organization knows how to recover when capability outruns judgment.
Sources and research trail¶
- National Institute of Standards and Technology, “CAISI Issues Request for Information About Securing AI Agent Systems” (January 12, 2026).
- National Institute of Standards and Technology, Zero Trust Architecture (2020).
- National Institute of Standards and Technology, Computer Security Incident Handling Guide (2012).
- Saltzer and Schroeder, “The Protection of Information in Computer Systems” (1975).
- Amershi and colleagues, “Guidelines for Human-AI Interaction” (2019).