Security and identity

A model cannot reliably tell an instruction from data. So an attacker will sometimes trick an agent, and the design must assume it. The security and identity layer (R10) decides who each agent is and what it may do. It is one of the fourteen layers you own. Today it holds workforce identity, privileged access, customer identity and security monitoring. For agents, this layer must make sure a tricked agent can do very little harm. Each agent gets its own short-lived identity, with only the access its task needs. A policy decision point checks every action that matters, and the agent cannot skip it. That check sits outside the model, as enforcement outside the model describes. AI-based filters may warn, but they never decide. In the four deterministic zones, models may take permission away, never grant it. This layer provides identity and policy, one of the seven capabilities an agent platform adds.

What sits in this layer today

Here is what a typical estate already runs in this layer. Vendors in brackets are examples, not a market claim.

Standards: the Essential Eight and the ISM in Australia, NZISM in New Zealand, and ISO 27001. Energy adds the AESCSF, the SOCI Act 2018 risk management rules and IEC 62443. US generators work under NERC CIP. Hospitals add HISO 10029, Queensland IS18, the NSW Cyber Security Policy and health privacy laws. The full estates are on the utilities, healthcare and energy pages.

What agents add

layer · architecture

The deterministic authorization chain

Every consequential action passes a policy decision point the agent cannot bypass; guardrails are an advisory side tap, never the boundary.

1. 01Agent

   Agent

   Agent identity

   Registered, least-privileged, short-lived, named owner and risk tier

2. 02Control

   Control

   JIT elevation

   RFC 9396 rich authorization; automatic drop-back

3. 03Control

   Control

   Policy decision point

   Cedar-class sub-millisecond or OPA; the agent cannot bypass it

4. 04System

   System

   Tool / action

5. 05Boundary

   Boundary

   Guardrails

   Advisory: measured evasion 72-77%

6. 06Control

   Control

   Information-flow control

   Deterministic; plus formal output verification where warranted

Fail closed when the policy engine fails; time-to-revoke is a measured metric.

Diagram description: Authorization chain from registered agent identity through just-in-time elevation and the gateway to a policy decision point and the tool, with guardrails as an advisory side channel and verification stages in parallel. The map contains Agent identity: Registered, least-privileged, short-lived, named owner and risk tier; JIT elevation: RFC 9396 rich authorization; automatic drop-back; Policy decision point: Cedar-class sub-millisecond or OPA; the agent cannot bypass it; Tool / action; Guardrails: Advisory: measured evasion 72-77%; Information-flow control: Deterministic; plus formal output verification where warranted. Its connections are identity to jit; jit to pdp; pdp to tool for allow, deny, limit, stop; guardrail to pdp for advisory signal only; ifc to tool for parallel verification. Important boundary: Fail closed when the policy engine fails; time-to-revoke is a measured metric.

A model cannot tell instructions from data

A transformer model treats every tokenToken. The unit AI usage is measured and billed in, roughly three-quarters of a word. the same way. A token is the small unit of text a model reads. So training alone cannot make it separate commands from data (Bhattarai and Vu, February 2026). EchoLeak shows what follows (CVE-2025-32711, severity 9.3 out of 10). It was a zero-click leak of data through a mailbox attached to Copilot. The injected instructions looked like ordinary content to the model. Unit 42 has since documented indirect prompt injection in the wild. A prompt injectionPrompt injection. An attack where instructions hidden in content the agent reads (an email, a web page, a document) trick it into doing something its user never asked for. is an instruction hidden in content the agent reads. So assume injection sometimes succeeds. Identity scoping, the policy decision point and payment mandates all exist to cap what a tricked agent can do.

Each agent has its own identity

Register every agent with a named owner and a risk tier. The tiers are Tier 1 (basic), Tier 2 (enhanced) and Tier 3 (strict). Remove shared credentials first. An agent using a person's login is shared credentials (ID1), the pattern to remove. Every agent needs at least its own identity (ID2), as the delegation chain sets out. The delegation chain traces every action to the person who asked.

Keep standing access small. Grant extra access just in time for one task, and let it drop back on its own [vendor]. To authorise a single action, use OAuth Rich Authorization Requests (RFC 9396). These put the action's details inside the access token, instead of a broad scope. Credentials are short-lived and cryptographically anchored, in the words of the US agency CISA. NIST's National Cybersecurity Center of Excellence has a demonstration project dated February 2026. It joins OAuth, SPIFFE and MCP into this chain. SPIFFE is a standard that gives running software its own proof of identity.

The kill switchKill switch. A guaranteed way to stop an agent immediately, built at more than one point so that one failure cannot disable it.Read the page is an identity feature. Time to revoke an agent's credentials is the number that proves it works, so drill it.

A few long-lived agents may also need an agent user account. That brings a mailbox, a meeting seat or directory visibility. Grant one only where the sponsor accepts that the agent becomes findable and can be phished. The productivity and collaboration layer (R08) covers that grant.

Agent identity products are still arriving. As of 14 October 2026, only Microsoft confirms on its own pages that its agent identity is generally available [vendor]. That is Entra Agent ID, with Agent 365 and its agent registry. Other vendors' release claims come from trade press, their own blogs or announcements without a date.

A policy decision point the agent cannot skip

The authorisation check is policy written as code, in the path of every toolTool. A function an agent can call to do something real: look up a record, send an email, run a query. Tools are where agents touch your systems. call. A policy decision pointPolicy decision point. The component that says yes or no to an action by checking rules against who is asking. The agent asks, the decision point decides, and the agent cannot skip it.Read the page evaluates it, and the agent cannot bypass it. The tool gateway in the integration fabric layer (R03) enforces the answer. This layer decides, and the gateway enforces.

The engine choice is a trade. Cedar evaluates in under a millisecond and is formally verified, but holds no state. Open Policy Agent, with its Rego language, handles richer lookups against outside data. OpenFGA and SpiceDB cover permissions based on relationships. The decision point fails closed. If the engine is down, actions that matter stop.

Two extra checks exist, at different stages of maturity. Microsoft's FIDES information-flow control is experimental and Python-only (7 October 2026) [vendor]. It is not supported where code runs. In Microsoft's own test it held policy-breaking injections to zero, against 20 to 152 without it [vendor]. Where code runs, only the sandbox, network egress and credential controls protect you. AWS's Bedrock Automated Reasoning checks verify outputs against formal logic [vendor]. They have been generally available since 6 August 2025.

Filters warn, they never decide

Published tests settle this. In one 2025 study, 72 to 77 percent of attacks got past three commercial filters. In some setups the figure reached 100 percent. Attacks tuned to the defence do even better. An October 2025 study broke 12 published defences, most at above 90 percent success (arXiv 2510.09023). Human red-teamers beat every one. NIST saw agent-hijacking success rise from 11 to 81 percent once attacks were tuned to the defence (January 2025).

Vendors report far lower rates, on their own tests that do not adapt [vendor]. The one setup measured at zero bypass blocked 16.22 percent of legitimate requests. It also added about 1.5 seconds per call. A policy engine decides in under a millisecond to a few milliseconds, about a thousand times faster. Filters are also a target, because an attacker can trip one on purpose to block service. So keep guardrailsGuardrail. A filter that uses an AI model to catch bad inputs or outputs. Useful as an early warning, but not reliable enough to be the thing that grants or denies an action.Read the page for content policy, personal data detection and telemetry, where a miss is tolerable. They never authorise an action.

In four zones, a model may block but never approve

The four zones are access, money movement, safety actuation and formal regulatory records. In them, a fixed rule or a named person decides. Model outputs are advice. Models may take permission away, never grant it. Machine learning signals inside three zones are part of the design. Entra ID Protection feeds risk scores into fixed Conditional Access rules. Mastercard scores every transaction while authorisation stays rule-based. Filings are drafted with AI, then a person attests to the record.

Safety actuation is the one zone where standards keep machine learning out of the function itself. IEC 61511 governs safety instrumented systems, the certified equipment that shuts a process down safely. ISO/IEC TR 5469:2024 places AI outside the fixed safety function. Records rules ask for accountability and records that cannot be changed. They do not ask for fixed generation. FINRA notice 24-09 (June 2024) confirmed that existing obligations apply whatever the technology. ESMA said the same in May 2024.

Deloitte Australia repaid the final instalment, A$97,587, of a contract worth about A$440,000. That followed fabricated references found in a government report (October 2025).

Two rules sit beside the zones. The destruction rule covers deleting or resetting production systems. The rule for decisions about people says a named person decides any significant decision about a person.

A worked example: a plant investigation agent

Take a generator whose agent investigates a pump that keeps tripping. The agent runs on the business network or in the cloud, not in the plant. It needs its own identity in IT and in the plant network's buffer zone. It reads historian copies, the maintenance system and the lab system through a read broker. It may write only a draft notification in the maintenance system. Nothing it does writes to a control system, a safety system or a protection relay. Nothing it does issues a permit or applies an isolation. Those stay with operators and certified systems, inside the safety actuation zone.

Payment mandates follow the same pattern

The card networks built the same pattern on their own. Visa's Trusted Agent Protocol (October 2025) uses tokens limited by amount, merchant and category. Mastercard Agent Pay (April 2025) uses tokens bound to agent, merchant and consent, revocable in real time. Google's Agent Payments Protocol (September 2025) uses signed mandatesMandate (payments). A signed, scoped permission to spend: how much, with whom, for what, until when. The payment network checks it, and the agent cannot change it. with hard limits. A mandate is a signed permission to spend: how much, with whom, for what, and until when. The mandate does not protect how the agent forms its intent. Testers in January 2026 used prompt injection that stayed inside a mandate's limits. The mandate limits the damage. Defending against injection, and a person confirming intent, are still needed.

The security team needs agent detections

Four public documents now describe how agents get attacked. The OWASP Top 10 for Agentic Applications (9 December 2025) runs from goal hijack to rogue agents. Two of its entries change enterprise controls: memory poisoning, and attacks on people's trust in agent messages. MITRE ATLAS added fourteen agent techniques in October 2025. Microsoft's failure-mode taxonomy (June 2026) counts 99 vulnerabilities in 2025 linked to MCP. Six national cyber agencies advise starting low-risk and granting no broad access (April to May 2026). Map detections to MITRE ATLAS and OWASP. Write agent runbooks. Keep reasoning traces and mandate logs as evidence. Spotting abnormal agent behaviour is still unsolved in mainstream security monitoring tools.

What must be true before an agent touches it

Before an agent holds any credential, these must hold.

• It is registered. It has a registry record, a named owner, a sponsor and a risk tier, as the agent lifecycle sets out.
• It shares no one's login. It has its own identity (ID2), and the delegation chain holds at every hop.
• Its access is small and short-lived. Extra access is granted per task and expires on its own.
• A decision point guards every action that matters. It fails closed, and the agent cannot bypass it.
• Filters stay off the authorisation path. They may warn or block content, but never approve an action.
• The zones are mapped. Every action in access, money, safety or formal records has a fixed rule or a named person deciding.
• It can be switched off fast. Kill switches exist in identity, the runtime and the gateway. Time to revoke is drilled.
• The security team can see it. Detections, runbooks and agent evidence reach the security operations centre.

The enforcement point is the policy decision point, enforced at the tool gateway. Both sit outside the model.

Regulators already expect this. Australia's Information Security Manual added agent controls in its September 2026 release (ISM-2133 to ISM-2135). The control numbers come from a compliance firm's walkthrough, so check them at cyber.gov.au. APRA wrote to banks and insurers on 30 April 2026. It expects an AI inventory, ownership across the lifecycle and security testing of AI-written code. It also expects privileged-access management for non-human actors, under CPS 230 and CPS 234. The Monetary Authority of Singapore issued final AI risk guidelines on 7 October 2026. They ask for an AI inventory that can carry agent identifiers and tool access. They set no agent-specific controls yet. The governance, risk and sovereignty layer (R11) covers the wider governance rules.

Choices and their verdicts

Each choice is the common choice, tested against the simplest credible alternative. The full records are in the decision catalog.

• Guardrail products or fixed gates (CD-16): fixed gates own the authorisation boundary. Filters are advice wherever they run.
• Dedicated AI security platforms or SIEM extension (CD-13): the market is folding AI security into existing platforms. Buy that way, but spotting abnormal agent behaviour is still unsolved.

Concerns this layer must honour

The ten cross-cutting concerns are set out in the concern matrix. This layer carries a specific duty for seven of them.

• Identity and access: the core of this layer. Registered agent identities, just-in-time access, short-lived credentials and a decision point on every action that matters.
• Observability: agent security telemetry flows to the SIEM. Baselining normal agent behaviour is an open gap.
• Traceability and audit: policy decisions, mandate logs and reasoning traces are kept where they cannot be changed.
• Impersonation: agent identity is proven, and agent messages to people resist spoofing.
• Sovereignty: credentials, tokens and telemetry stay in the required place.
• Safety and oversight: the four zones, intent confirmation for actions that matter, and the kill switch.
• Resilience: revocation drills, and fail closed when a policy engine fails.

Evidence and limits

The incident record supports the core reason. It includes EchoLeak, 99 MCP-linked vulnerabilities in 2025, and injection seen in the wild. Published attack studies support the verdict on filters, including tests with attacks tuned to the defence.

Several figures come from vendors and carry the [vendor] tag. They include the identity release dates, the FIDES result and the reasoning checks. Vendor results for model-based reviewers are not replicated. They were probably measured without adaptive attacks.

Some points are second-hand. They include the six-nation guidance date, the ISM control numbers and most agent identity release claims. The standards for passing delegation between agents are drafts. The FINRA 25-07 reading traces through a vendor blog, so check it at finra.org before relying on it.

Next step

See this layer at work in the proposed referral to appointment example. There, the agent's credential cannot set clinical urgency. Then read the next layer, the governance, risk and sovereignty layer (R11).

Explore this topic

• Security and identity findings and sources.
• Products named for orientation, on the one-page wall chart.
• Estate table: industry research for utilities, healthcare and energy, 15 October 2026. Rows are industry knowledge unless a source is named.
• Root cause: Bhattarai and Vu, February 2026. EchoLeak, CVE-2025-32711, CVSS 9.3. Unit 42 on indirect prompt injection in the wild. Agent tooling has also suffered supply-chain compromise.
• Threat documents: OWASP Top 10 for Agentic Applications, 9 December 2025, ASI01 to ASI10. ASI06 is memory poisoning and ASI09 is human-trust exploitation.
• MITRE ATLAS added fourteen agent techniques in October 2025. It stands at 16 tactics, 84 techniques and 42 case studies. Microsoft failure-mode taxonomy v2.0, June 2026.
• Six national cyber agencies, joint adoption guidance, April to May 2026. It names five risk categories. Its exact publication date is second-hand.
• Identity baseline: non-human identities outnumber people by about 100 to 1. 97 percent hold more access than they need [vendor].
• Cloud Security Alliance and Oasis survey, January 2026 [sponsored]. 23 percent have a formal agent identity strategy. 92 percent doubt legacy identity tools can manage the risk.
• Just-in-time access was published as the least-privilege pattern for agents in July 2026 [vendor]. CISA guidance on short-lived, cryptographically anchored credentials. NIST NCCoE demonstration project, February 2026.
• Identity release status as of 14 October 2026: Microsoft Entra Agent ID is confirmed on the vendor's pages [vendor]. Agent 365 became generally available on 1 May 2026, with the Entra agent registry [vendor].
• Okta announced a kill switch with general availability scheduled for 30 April 2026. The pages read do not confirm it shipped [vendor].
• SailPoint (4 August 2026) and CyberArk, now sold as Idira (January 2026), claim general availability. The claims appear only in trade press or their own blogs. Ping announced on 27 May 2026 with no date.
• FIDES: Microsoft documentation, 7 October 2026. Experimental, Python-only, not supported with code-execution providers, and silent on file and network access [vendor].
• Bedrock Automated Reasoning checks, generally available 6 August 2025 [vendor].
• Filter tests: LLMSEC 2025 workshop of the ACL. About 72 percent of attacks got past Azure Prompt Shield. 77 percent got past Protect AI v1, and 72.5 percent past NeMo jailbreak detection. Adaptive attacks: arXiv 2510.09023, October 2025. NIST agent-hijacking evaluations, January 2025.
• Zero-bypass configuration: arXiv 2605.06669, 16.22 percent false positives and about 1.5 seconds added. Filters as a denial-of-service target: arXiv 2410.02916.
• Vendor reviewer results, not replicated: a classifier caught 89 percent of dangerous commands against 13.6 percent for people. 0 of 720 bypasses (August 2026). 99.3 percent reviewer recall [vendor].
• Zones: Entra ID Protection and Conditional Access. Mastercard Decision Intelligence. ISO/IEC TR 5469:2024. FINRA 24-09 (June 2024). FINRA 25-07 (April 2025) asks for comment. ESMA, May 2024.
• Deloitte Australia: the refund was the final instalment, A$97,587, of a contract worth about A$440,000 (October 2025).
• Payments: Visa Trusted Agent Protocol (October 2025). Mastercard Agent Pay (April 2025). Google AP2 (September 2025, more than 60 partners, W3C Verifiable Credential format). AP2 red-team, January 2026.
• Regional texts: ISM September 2026 release, ISM-2133 to ISM-2135 and an amended ISM-2113. Earlier: an AI-assisted development control (June 2026) and an excessive-agency control (December 2025).
• APRA letter, 30 April 2026, under CPS 230 and CPS 234. MAS final AI risk management guidelines, 7 October 2026.
• Queensland's AI governance policy and the Australian privacy regulator's automated-decision rule sit on the governance, risk and sovereignty layer (R11).
• Delegation standards: OAuth 2.1 is a working-group draft. The OAuth draft on chaining identity across domains sits in the RFC Editor queue.
• Every agent-specific OAuth profile is an individual submission. NIST's agent control overlays have no public draft.
• Security market: six AI-security acquisitions in about fourteen months. Cisco and Robust Intelligence (2024). Palo Alto and Protect AI (July 2025). SentinelOne and Prompt Security (about $250 million).
• More acquisitions: F5 and CalypsoAI ($180 million). CrowdStrike and Pangea (about $260 million). Check Point and Lakera (about $300 million).
• Two non-human identity deals: Cisco and Astrix (about $400 million), and Cyera and Oasis (about $1 billion). Gartner expects guardian agents at 10 to 15 percent of the agentic market by 2030.
• The baselining gap was verified only to headline, from RSAC 2026 reporting. The primary report could not be retrieved.
• Excluded: the widely repeated count of agents registered on Microsoft's platform. It is an earnings self-report.
• Re-verify quarterly: the AI-security acquisition ledger and SIEM behaviour baselining after RSAC 2027. Also check the NCCoE project's output and the FINRA 25-07 outcome.