Methods, evaluations and reports.

Every conversation about AI agent risk is about intelligence: how smart, how autonomous, how deceptive. That is the wrong axis. The dangerous property of an agent is not how smart it is, it is how fast it is. Every human control is a timing assumption, and agents break all of them at once.

Every access control system rests on one assumption: read is safe, write is dangerous. For AI agents that distinction has quietly collapsed. An agent that can read can exfiltrate it, be steered by it, and reconnoitre with it. Read-only is not a safe default, and permission tiers no longer govern risk. The action does.

In 1988 Norm Hardy named a bug that has never been solved in the general case: the confused deputy, a program with real authority tricked by a less privileged party into misusing it. AI agents are the most powerful confused deputies ever built, with the authority of an enterprise and a caller list that includes the untrusted world.

We will just shut it down is the reassurance every executive reaches for about AI agents. It is a fantasy. The kill switch cannot detect the failure in time, cannot win the race against the agent, and cannot reverse what was already done. The only real off switch is a control on every action, before it executes.

You would reject the onboarding ticket before you finished reading it: standing access to everything, no probation, no review, acting at machine speed, influenced by untrusted input. That is how enterprises deploy AI agents. The agent is the new hire, and it needs the controls we spent decades learning humans required.

The coming AI agent disaster will have no bug, no broken component, no negligent engineer. The model will be correct, the credentials valid, the APIs healthy, the logs complete. Everything will have worked as designed. Correctness of the parts is not safety of the whole, and safety lives in the layer that governs the actions between them.

Enterprises are mistaking detailed agent logs for an audit trail. A log proves an action happened. A regulator asks whether the control operated, and you cannot reconstruct an authorisation decision that was never made. The audit record is a byproduct of authorising each action.

AI agents are non-human identities, but of a kind the NHI playbook was never built for. Vaulting, rotation, scoping and lifecycle all govern the credential. An agent’s risk lives in the action it decides to take. The credential controls are necessary but not sufficient.

The security industry spent a decade adopting Zero Trust, then quietly granted AI agents the exact implicit trust it dismantled. Agents violate every Zero Trust principle. Closing the gap means extending verification to the layer Zero Trust never had to reach: the individual action.

The security industry has spent two years trying to solve prompt injection at the model layer, where the defender cannot win. Prompt injection is not a model problem. It is an authorisation problem, and authorisation problems are solved at the authorisation layer.

Permission boundaries are not an optional hardening step for agentic systems. They are the foundational primitive that makes agents safe to deploy. This piece defines what a real boundary is, why the naive approaches fail, and how enforcement has to work to be meaningful.

OAuth was designed for delegated access between deterministic applications. AI agents are not deterministic. This piece breaks down the six specific places where OAuth fails for AI agents and what a proper authorisation layer requires.

AI agents are being deployed across enterprise systems without the one infrastructure layer they need most: an authorisation layer. This piece defines the pattern, explains why existing approaches fail, and lays out what production-grade AI agent governance actually looks like.