Zerotrust,appliedtothingsthatarenotpeople.
Written for security architects. An autonomous caller has the reach of an integration and the improvisation of a user, and most enterprise controls were designed for neither.
Whatisactuallydifferentaboutagents
An agent's input is untrusted by construction. It reads documents, tickets, telemetry and web content, any of which can contain instructions. Prompt injection is not an exotic attack; it is the expected condition of operating on real enterprise content. The consequence is that you cannot rely on the model to enforce anything, because the model is the component under attack.
The design response is to make the model's output a request rather than an instruction. Authority lives outside the model, in a component that does not read the untrusted content. If an injected instruction persuades an agent to attempt something outside its mandate, the attempt fails at the control plane, and the attempt itself becomes a security signal.
Everything below follows from that principle.
Controls
Non-human identity
Per-agent principals with their own lifecycle, owner and audit trail. No shared service accounts, because they destroy attribution before an investigation starts.
Short-lived credentials
Credentials are issued per run, scoped to the run's mandate, and expire on completion. A leaked credential has a short and bounded blast radius.
Secrets handling
Agents do not hold secrets. The broker holds them, uses them on the agent's behalf, and never places them in a context window.
Sandboxing
Code execution and tool use run in isolated, ephemeral environments with no persistent filesystem and no ambient network access.
Network isolation
Default-deny egress with explicit allowlists per mandate. Most agents need to reach nothing outside the cluster.
Tool authorization
Every tool call is authorized against the mandate at invocation time, with argument constraints and rate limits enforced by the broker.
Tenant isolation
Separation of data, indexes, credentials, evidence and compute between tenants, with isolation verified rather than assumed.
Runtime monitoring
Behavioural signals on agent activity: denied attempts, scope probing, unusual tool sequences, anomalous spend and volume.
Supply chain
Provenance for container images, model artefacts, dependencies and MCP servers, with version pinning and change review.
Kill switch
A tested path to stop one agent or all agents, revoke issued credentials and halt in-flight runs.
IT/OT segmentation
Asymmetric boundary control: observation crosses through a one-directional broker, unattended action does not cross at all.
Evidence as a security artefact
The decision record doubles as an investigation record: what was read, what was called, what was denied, and under whose authority.
Denials are signal
A well-governed agent estate produces a steady stream of denied attempts. Reviewing them is one of the highest-yield security activities available, because it shows where mandates and reality disagree.
Threatsandthecontrolthataddressesthem
| Threat | Primary control | Residual risk to manage |
|---|---|---|
| Prompt injection via ingested content | Authority enforced outside the model; default-deny scope | Injected content can still mislead a human approver — hence assembled cases and citations |
| Credential theft from an agent | Agents hold no secrets; per-run short-lived credentials | Broker compromise; mitigated by isolation and monitoring |
| Excessive access accumulated over time | Mandate expiry, scheduled review, per-object scope | Reviews that are performed nominally; mitigated by evidence of actual reads |
| Data exfiltration through a tool or MCP server | Default-deny egress, argument constraints, server registration | Legitimate egress paths; mitigated by volume monitoring |
| Confused deputy via agent-to-agent delegation | Authority narrows on delegation; chain recorded | Complex delegation graphs; mitigated by depth limits |
| Unattended action in an OT environment | No unattended write across the IT/OT boundary | Operator fatigue; mitigated by decision quality rather than volume |
Questions
- How do you handle prompt injection?
- By assuming it succeeds. Input filtering and detection are used, but they are defence in depth rather than the control. The control is that a persuaded model cannot exceed its mandate, because the mandate is enforced by a component that never reads the untrusted input.
- Do you have SOC 2 or ISO 27001?
- Certification status is stated plainly in the trust centre rather than implied here. Ask for the current position and the roadmap; we will not describe a framework we are working towards as one we hold.
- Can agents run entirely without internet access?
- Yes. Default-deny egress is the normal configuration, and fully disconnected deployment is supported for environments that require it.
- How is tenant isolation verified?
- Through architectural separation, automated tests that attempt cross-tenant access, and evidence records that are scoped per tenant. Ask for the detail in the security pack.
Continue
- Trust centreCertifications, residency, subprocessors and diligence material.
- Control planeWhere authority is enforced outside the model.
- RuntimeIsolation, sandboxing and observability.
- IntegrationsThe brokered pattern and MCP governance.
- Critical infrastructureIT/OT segmentation in practice.
- SovereigntyIdentity and operational sovereignty.
Bring us one operational problem.
You do not need a finished brief. Bring the problem — we will work out the next step together.
Or book a call with the team