The Three Questions Agent Security Has to Answer

2026-07-23 · Source: Towards AI - Medium · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Advanced, long

Summary

AI agent security fundamentally relies on answering three architectural questions: whose authority an action carries, what proof of that action exists, and what blast radius contains damage from incorrect actions. These are infrastructure-level challenges, not model-level. The article details four architectural patterns to address these. First, scoped token propagation, using OAuth 2.0 Token Exchange (RFC 8693) and Resource Indicators (RFC 8707), ensures user identity persists across agent-tool interactions. Second, decision-level interception mandates total logging of tool calls, model calls, and policy decisions into structured, tamper-evident records, crucial for compliance with EU AI Act Articles 12 and 14. Third, infrastructure-layer isolation, via hardware-virtualized microVMs like Firecracker, limits a compromised agent's reach. Finally, A2A authority chaining, using cryptographic delegation, manages security in multi-agent systems by narrowing scope at each hop. These patterns are critical as industry bodies like Forrester, OWASP, and NIST converge on agent security standards.

Key takeaway

For AI Architects or MLOps Engineers evaluating agent security, you must prioritize architectural patterns over model-level defenses. Implement scoped token propagation to ensure user identity persists across all agent interactions. Establish decision-level interception for comprehensive, tamper-evident audit logs, crucial for regulatory compliance. Additionally, deploy infrastructure-layer isolation using microVMs to contain potential damage from compromised agent executions. Run diagnostic traces to identify where identity collapses or blast radius is insufficient, guiding your immediate security enhancements.

Key insights

Agent security failures stem from infrastructure, not models, requiring architectural patterns for identity, proof, and containment.

Principles

• Agent security is an infrastructure problem.
• Identity must propagate end-to-end.
• Hardware isolation contains agent damage.

Method

Run three diagnostic traces: 1) follow originating identity through every tool call; 2) generate an audit query for agent actions, user, time, and authority; 3) determine execution-failure blast radius and enforcement layer.

In practice

• Implement OAuth 2.0 Token Exchange (RFC 8693).
• Use microVMs like Firecracker for isolation.
• Adopt decision-level interception for audit logs.

Topics

• Agent Security
• Identity Propagation
• MicroVM Isolation
• Decision Logging
• A2A Authority Chaining
• Agent Control Plane

Best for: AI Security Engineer, AI Architect, MLOps Engineer

Related on AIssential

• The Bounded Agent — AI coding agents require architectural security controls, treating them as untrusted principals, not just better instructions.
• The agent security gap: 54% of enterprises have already had an AI agent incident, and most still let agents share credentials — Enterprises face a critical AI agent security gap due to insufficient identity management and isolation controls, despite high satisfaction with borrowed tooling.
• The Identity Layer for AI Agents Is Finally Being Built — AI agents require a dedicated, layered identity and authorization stack distinct from human or service models.
• Quoting Sean Lynch — MCP's core value is isolating authentication flows from agent context, enhancing security and operational clarity.
• How we contain Claude across products — Effective agent security prioritizes deterministic environmental containment over probabilistic model-layer defenses to cap blast radius.
• Kagenti’s Approach to Multi-Agent Security for AI Agents — Combat "confused deputy" vulnerabilities in multi-agent AI systems by securing identity and delegation chains, not just paths.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Towards AI - Medium.