Why 'never trust, always verify - repeatably' security strategy for AI Agents, starts after login

In the realm of modern digital security, the traditional assumption that users or systems within a company network are trustworthy has been debunked by the advent of cloud storage, subscription-based software, and remote work. Consequently, security models have shifted focus to verifying user identity, scrutinizing computer hygiene, implementing multi-factor authentication during login, and continuously monitoring the user's claimed identity.

This approach functions effectively for human users. However, the emergence of autonomous AI agents introduces a new layer of complexity. Unlike standard software, AI agents autonomously interact with human instructions, draw context from company databases, utilize multiple tools, connect to external software, and trigger intricate workflows.

The security risk no longer lies at the login screen but extends after access has been granted. While verifying initial login authentication confirms the agent's recognition by the system, it offers limited insight into the safety, ethics, or correctness of the agent's subsequent actions. The focus has shifted to context. IT teams have encountered a similar challenge previously with non-human identities, such as automated service accounts, security tokens, and digital certificates, which allow software programs to communicate with one another.

These credentials often remain unmonitored, creating silent backdoors into the network. AI agents escalate this issue by exhibiting independent judgment. Unlike service accounts with pre-written code, AI agents interpret high-level goals, assess real-time context, select tools, and decide on action. As a result, security policies must extend beyond the initial access point and monitor every decision made by the agent.

To manage this risk, security leaders must distinguish between the degree of independence an AI agent possesses and the level of file access it holds. This distinction determines the required control level. For instance, a basic agent that summarizes documents requires limited reading rights and clear activity logs. Conversely, an agent tasked with updating sensitive databases, accessing code repositories, generating new code, or altering business workflows demands mandatory human approval steps, strict operational boundaries, and a clear reversal mechanism for any mistakes.

AI agents can be categorized into three levels of independence: 1. Conversational AI Agents (GenAI) are productivity agents developed and managed by employees, typically utilizing non-sensitive or production-related data. Security measures should include proper role-based access control (RBAC) authorization, logging, and response validation to ensure data integrity.

2. Agents Acting with Semi/Full Human Guardrails include customer support tools that draft emails or prepare database updates for review. Security teams must validate tool parameters and require human approval for actions involving writing, deleting, spending money, or sending information externally. 3. Fully Autonomous Agents, which can reset passwords or trigger complex workflows independently, necessitate the most stringent security measures.

These include comprehensive visibility (agent architecture, tool usage), active control measures, rate limits, continuous real-time policy checks, network access restrictions, runtime security controls (public/private cloud), continuous identity verification, minimal authorization verification, and complete, unalterable audit trails.

The industry is increasingly adopting autonomous agents, often requesting human approval for abnormal behavior. This leads to the question: Can your agent trigger such approval? The key to enforcing these policies lies in real-time inspection. Security teams need a dedicated vantage point within the network to inspect the human prompt, agent response, digital tools used, and data movement during the workflow.

This requires an architecture capable of discovering active agent activity across the business, governing agent use of internal tools, and maintaining complete visibility over data flows and automated workflows. The true value of this approach lies in context. By integrating network traffic, user activity, and cloud database logs with the agent's behavior, security teams can investigate incidents with clear evidence, identifying which agent ran, who owns it, what data was moved, and which automated tools were invoked.

For business leaders, this translates to more consistent governance across human users, software applications, and digital agents. The recommended starting point is to focus on a single AI workflow currently in use or on the verge of launch. Map out the workflow's context, identify the agent's capabilities and limitations, and apply the appropriate security controls based on the agent's level of independence.