securitycontrols.ai
Field notes
Working notes on securing autonomous AI agents — the threats, the controls, and how to prove they hold. Companion writing to the Agentic Security Control Matrix.
Start here
The argument+1 coming
THOUGHT-LEADERSHIPThe three gaps no framework closes
Most of securing an AI agent is well-trodden ground. Three gaps are not. They are the reason a crosswalk needs to exist, and the places I planted a flag of my own.
THOUGHT-LEADERSHIPA control nobody can prove is not a control
Most matrices tell you what a control is. The hard part is showing it actually holds. Every control here carries three proofs: is it configured, does it survive an attack, and what artifact says so on an ongoing basis.
THOUGHT-LEADERSHIPOne matrix, five sets of eyes
Securing an agent is not one job. The same control means something different to the engineer, the detection analyst, the red teamer, the GRC lead, and the responder. So every control in the matrix reads through all five.
The six layers
LAYER · IDENTITYIdentity and authority: who the agent is, and what it can do
The first layer of the matrix. Five controls that decide which agent did what, and what each one was allowed to do, plus how to prove each holds.
LAYER · CONTAINMENTEnvironment and containment: where the agent runs, and what it can reach
The second layer of the matrix. Nine controls built on one assumption: sooner or later the agent will be wrong or hijacked, so bound the blast radius before it happens.
LAYER · PROTOCOLInter-agent and tool protocols: how the agent talks to tools and to other agents
The third layer of the matrix. Seven controls for the wires between an agent and everything it talks to, where the supply chain and the injection risk concentrate.
LAYER · GOVERNANCEGovernance and human-in-the-loop: who approves, and what is on the record
The fourth layer of the matrix. Nine controls for the human checkpoints, the records, and the accountability that keep an autonomous system answerable.
LAYER · RUNTIMERuntime supervision and detection: what the agent actually does, watched live
The fifth layer of the matrix. Eight controls for watching an agent as it runs, including the frontier ones nobody has fully solved yet.
LAYER · ASSURANCEContinuous assurance: proving it before it ships, and after
The sixth layer of the matrix. Seven controls that prove an agent is safe to run, before it goes live and re-proven on every change after, the gates, the supply-chain checks, and the proof that it holds at all.
The vendor landscape
VENDOR-LANDSCAPE · IDENTITYHow the identity layer is being built
A snapshot of who is building agent identity and authorization, organized by the controls they map to. Standards first, vendors second, no recommendations.
VENDOR-LANDSCAPE · CONTAINMENTHow the containment layer is being built
A snapshot of who is building agent containment, organized by the controls they map to. Standards first, vendors second, no recommendations, and an honest map of where no product exists yet.
VENDOR-LANDSCAPE · PROTOCOLHow the inter-agent and tool-protocol layer is being built
A snapshot of who is building the protocol layer, organized by the controls they map to. Standards first, vendors second, and an honest note on how much of the security is still missing.
VENDOR-LANDSCAPE · GOVERNANCEHow the governance layer is being built
A snapshot of who is building agent governance, organized by the controls they map to. Standards and regulation first, vendors second, no recommendations.
VENDOR-LANDSCAPE · RUNTIMEHow the runtime layer is being built
A snapshot of who is building the runtime supervision layer, organized by the controls they map to. Standards first, vendors second, no recommendations.
VENDOR-LANDSCAPE · ASSURANCEHow the continuous assurance layer is being built
A snapshot of who is building continuous assurance, organized by the controls they map to. Standards and open work first, labs and vendors second, no recommendations.
VENDOR-LANDSCAPE-CAPSTONEConvergence, new energy, and the seams
Stepping back from the six layers: where the field is consolidating, where the genuinely new energy is, and who is, and is not, moving on the three gaps no framework closes.