Methods, evaluations, and reports.
The instinct when an AI agent makes you nervous is containment: sandbox it, isolate it. That is aimed at the wrong threat. An agent never needs to escape the box. It causes harm through the database, email and API connections you deliberately put inside the box with it. Govern the action, not the environment.
Authentication can establish the identity of an AI agent. It cannot determine whether that agent has the authority to perform a specific action. As autonomous AI moves into production, security must extend from identity to action-level authorisation before execution.
Enterprises are responding to AI agents by forming a governance committee: a board, a framework, a policy, a quarterly review. None of it governs a single thing an agent does. Deliberative, human-paced governance cannot touch actions happening thousands of times a minute. Governance has to become executable, at the action.
The agent pilot went perfectly, so you ship it. That is the mistake. A pilot is safe for reasons that have nothing to do with the agent: a human watching, low volume, narrow scope, friendly data, low stakes. Production removes every one of them. The safety was situational, not structural, and it does not transfer.
Every conversation about AI agent risk is about intelligence: how smart, how autonomous, how deceptive. That is the wrong axis. The dangerous property of an agent is not how smart it is, it is how fast it is. Every human control is a timing assumption, and agents break all of them at once.
Every access control system rests on one assumption: read is safe, write is dangerous. For AI agents that distinction has quietly collapsed. An agent that can read can exfiltrate it, be steered by it, and reconnoitre with it. Read-only is not a safe default, and permission tiers no longer govern risk. The action does.
In 1988 Norm Hardy named a bug that has never been solved in the general case: the confused deputy, a program with real authority tricked by a less privileged party into misusing it. AI agents are the most powerful confused deputies ever built, with the authority of an enterprise and a caller list that includes the untrusted world.
We will just shut it down is the reassurance every executive reaches for about AI agents. It is a fantasy. The kill switch cannot detect the failure in time, cannot win the race against the agent, and cannot reverse what was already done. The only real off switch is a control on every action, before it executes.
You would reject the onboarding ticket before you finished reading it: standing access to everything, no probation, no review, acting at machine speed, influenced by untrusted input. That is how enterprises deploy AI agents. The agent is the new hire, and it needs the controls we spent decades learning humans required.
The coming AI agent disaster will have no bug, no broken component, no negligent engineer. The model will be correct, the credentials valid, the APIs healthy, the logs complete. Everything will have worked as designed. Correctness of the parts is not safety of the whole, and safety lives in the layer that governs the actions between them.
Enterprises are mistaking detailed agent logs for an audit trail. A log proves an action happened. A regulator asks whether the control operated, and you cannot reconstruct an authorisation decision that was never made. The audit record is a byproduct of authorising each action.
AI agents are non-human identities, but of a kind the NHI playbook was never built for. Vaulting, rotation, scoping and lifecycle all govern the credential. An agent’s risk lives in the action it decides to take. The credential controls are necessary but not sufficient.
The security industry spent a decade adopting Zero Trust, then quietly granted AI agents the exact implicit trust it dismantled. Agents violate every Zero Trust principle. Closing the gap means extending verification to the layer Zero Trust never had to reach: the individual action.
The security industry has spent two years trying to solve prompt injection at the model layer, where the defender cannot win. Prompt injection is not a model problem. It is an authorisation problem, and authorisation problems are solved at the authorisation layer.
Permission boundaries are not an optional hardening step for agentic systems. They are the foundational primitive that makes agents safe to deploy. This piece defines what a real boundary is, why the naive approaches fail, and how enforcement has to work to be meaningful.
OAuth was designed for delegated access between deterministic applications. AI agents are not deterministic. This piece breaks down the six specific places where OAuth fails for AI agents and what a proper authorisation layer requires.
AI agents are being deployed across enterprise systems without the one infrastructure layer they need most: an authorisation layer. This piece defines the pattern, explains why existing approaches fail, and lays out what production-grade AI agent governance actually looks like.
Put one workflow behind Xybern and watch every agent action authorised, and sealed to the vault.
Xybern