Recent security-testing incidents underline an architectural fact: a model instruction is not a security boundary. If an agent can browse, retrieve secrets and call tools, its effective authority is the union of every permission connected to it.
A safer agent stack starts with four separations. Identity should be per agent and per task, not a shared service account. Network access should be allow-listed by destination. Credentials should be short-lived and scoped to a single action. Irreversible or externally visible actions should pass through a separate approval service.
Design for disagreement
Agent output should be treated as a proposal. The execution layer should independently check the target, policy, data classification and maximum impact. This is the same reason payment systems separate instruction from settlement: the component asking for an action should not be the only component deciding whether it is allowed.
Singapore’s updated Model AI Governance Framework for Agentic AI makes the issue operational, addressing accountability, risk boundaries, multi-agent systems and automation bias. NIST’s AI Risk Management Framework supplies a broader cycle for governing, mapping, measuring and managing risk. Together they point towards systems that can produce an audit trail rather than merely an answer.
The practical target is a known blast radius. Teams should be able to state, before deployment, the maximum data an agent can read, the systems it can change, the money it can spend and the fastest way to revoke it. If those answers are unclear, the system is not ready for autonomous operation.