Zero Trust
Never trust, always verify.
No agent, service, or generated line of code is trusted by default. Every identity is scoped, every request is authenticated, every action is logged. Trust is not a location on the network or a name in a config — it is earned per request and revoked the moment it stops being verifiable. In a world where autonomous agents hold real credentials, this is the only posture that survives contact with reality.
Layers Responsible for Their Own Security
Structure the system so misbehavior is impossible, not merely detected.
When each tier is built to enforce its own security — the database applying row-level access no matter what the caller claims, the boundary refusing anything unauthenticated, a layered schema (api_v1 → private_logic → data) where no layer reaches past its mandate — agents are structurally forced to follow the rules. You don't hope the agent behaves; the architecture won't let it misbehave. Guardrails stop being a policy you enforce and become a property of the system.
Every convenience an autonomous agent adds is a trust boundary it widens. Five places the ground shifts when the machines start writing the machines — each an old threat wearing a new face.
Agents with keys
The Risk
An autonomous agent now holds real credentials and acts in production on its own initiative. A single confused or hijacked step can reach everything the key can reach.
The Defense
Least privilege by default. Short-lived, narrowly scoped tokens. Blast radius contained by design — ephemeral workers, sealed outputs, no standing access.
Prompt injection
The Risk
The model treats retrieved documents, tool output, and user text as instructions. Untrusted input becomes untrusted control flow — the new injection class, aimed at the reasoning layer.
The Defense
Treat every token the model reads as untrusted. Separate data from instructions, constrain tool permissions, and validate output before it is allowed to act.
AI-generated vulnerabilities at scale
The Risk
Agents are prolific producers of plausible, confident, insecure code — shipped faster than any human can read it. Volume, not malice, is the threat.
The Defense
The reviewer whose standards the agent cannot skip. Automated quality gates, pre-commit hooks, and a hard rule: no silent failures, no swallowed exceptions, nothing merged unverified.
Supply chain & secret leakage
The Risk
Agents pull dependencies, read environments, and can spill secrets into logs, prompts, and traces — quietly widening the trust boundary with every convenience.
The Defense
Provenance and pinned dependencies. No secrets in the client. Secret scanning in the pipeline. Configuration from the environment, never the codebase.
Erosion of auditability
The Risk
When machines act autonomously with no trail, there is no accountability — no way to answer what happened, who authorized it, or whether the degradation is still spreading.
The Defense
Assume breach; verify everything. Every action authenticated and logged, every failure made visible to the caller. A system you cannot audit is a system you cannot trust.
Most voices on AI security are security people learning AI, or AI people who have never held a clearance. This sits on a rarer intersection: fifteen-plus years building software inside defense logistics (USTRANSCOM, Scott AFB, JALIS classified missions) where security was the mission — crossed with hands-on agent architecture, where I granted the credentials and know exactly what each agent can touch, and the governance discipline to put guardrails on the whole thing.
The Bottom Line
The machines write the machines now. The work that matters is making sure they can only ever write inside the lines — enforced by the architecture, verified on every request, trusted by nothing.