Resources

The Screenshot Nobody Owned

Every control at the bank worked as designed, and the institution still could not say what its AI agent did. Why agents make the action itself the thing that has to be governed.

There's No Scope For That

Least privilege assumes permissions come in roughly the size of the job. For agents they usually don't, and the gap between the scope you granted and the rule you meant is where the incident lives.

Authorized to Operate Is Not Allowed to Act

An ATO proves the system meets a security baseline. It does not prove what one agent is allowed to do, who tested those limits, or what enforces them at runtime. Federal customers are already asking.

Your Employees Already Have Agents. Where Do They Point?

An employee's AI agent found a flaw in someone else's production system and acted without explicit instruction. What CISOs need to know about governing agents with real access.

The Call Is Coming From Inside the House

Mythos-class attackers are real, but the most consequential agent incident of 2026 had no attacker in it. Why your existing controls do not bound autonomous systems.

Assume the Injection Succeeds

You can't stop every prompt injection. But you can decide what a successful one is allowed to do. A product security playbook for agentic features.