[{"data":1,"prerenderedAt":421},["ShallowReactive",2],{"blog-\u002Fblog\u002Fenterprise-ai-agent-security-boundaries":3,"blog-related-\u002Fblog\u002Fenterprise-ai-agent-security-boundaries":396,"blog-surround-\u002Fblog\u002Fenterprise-ai-agent-security-boundaries":420},{"id":4,"title":5,"audience":6,"body":11,"cluster":357,"conversionGoal":358,"cornerstone":359,"date":360,"description":361,"draft":362,"extension":363,"factCheckedAt":358,"faq":364,"featured":362,"language":358,"meta":377,"minRead":378,"navigation":359,"order":379,"originalAsset":358,"path":380,"pillar":381,"primaryKeyword":382,"publicationOrder":383,"relatedProject":358,"releaseScope":358,"reviewCycle":384,"reviewMethod":385,"reviewStatus":386,"reviewedAt":360,"reviewedBy":387,"searchIntent":388,"seo":389,"sources":358,"stem":390,"tags":391,"type":394,"updated":360,"__hash__":395},"blog\u002Fblog\u002Fenterprise-ai-agent-security-boundaries.md","Security Boundaries for Enterprise AI Agents",[7,8,9,10],"enterprise-architect","engineering-manager","transformation-lead","financial-controller",{"type":12,"value":13,"toc":346},"minimark",[14,22,25,28,33,36,42,48,54,58,61,69,72,78,90,94,97,107,113,118,156,163,169,173,180,183,194,200,211,217,221,229,237,240,244,252,312,315,318,322,330,333],[15,16,17,21],"p",{},[18,19,20],"strong",{},"An enterprise agent that reads a document can be instructed by that document, and there is no reliable way to stop it."," Instruction and data arrive on the same channel, get tokenised the same way, and are weighed against each other by a process that has no notion of provenance. Every serious mitigation is therefore about consequence rather than prevention: assume something in the context window will eventually be hostile, and make that fact boring.",[15,23,24],{},"That framing is not a counsel of despair. It is the ordinary way controls work in a function that moves money. Nobody designs a payment process on the assumption that no one will ever try a fraudulent invoice — you assume it, and you build so that trying is expensive and succeeding is hard. This is the same discipline applied to a new kind of participant.",[15,26,27],{},"I have spent eighteen years designing and reviewing controls in enterprise finance systems: least privilege, joiner-mover-leaver, four-eyes on payments and on the static data behind them, break-glass access that has to be logged because it will be used at 2am. What follows is that discipline reasoned forward onto agents. Where the AI-specific behaviour is contested or moves quickly, I have said so rather than asserted a fix.",[29,30,32],"h2",{"id":31},"the-three-questions-a-security-review-actually-asks","The three questions a security review actually asks",[15,34,35],{},"Not \"is the model safe\". Three concrete ones, and a design that cannot answer all three is not ready to be reviewed.",[15,37,38,41],{},[18,39,40],{},"What can it read?"," Not what you intended it to read — what its credential permits.",[15,43,44,47],{},[18,45,46],{},"What can it do?"," The set of side effects reachable from its tools, including the ones reachable indirectly.",[15,49,50,53],{},[18,51,52],{},"Whose authority is it acting under, and how do you take that away?"," Attribution and revocation, which are the two things an incident needs and the two things a shared service account destroys.",[29,55,57],{"id":56},"read-is-not-the-safe-half","Read is not the safe half",[15,59,60],{},"The instinct is to treat read-only as the harmless configuration and put the caution on writes. That instinct is half right and the half it gets wrong is the one that leaks.",[15,62,63,64,68],{},"Enterprise content permissions were built around two implicit limits: a person has to know where a document is, and a person has limited hours. Most over-broad permission sets have been harmless for years because both limits held. An agent has neither. A share that \"everyone in finance can technically open\" becomes, the day you point a retrieval system at it, a share that everyone in finance can ",[65,66,67],"em",{},"ask questions about"," — including questions nobody would have thought to go looking for the answer to.",[15,70,71],{},"So the read boundary is a scoping decision, and it is not the same as the permission model you already have. Two rules that hold up:",[15,73,74,77],{},[18,75,76],{},"Scope retrieval to the task, not to the user's entitlements."," An agent answering questions about supplier invoices needs supplier invoices. Giving it the requesting user's full document reach because that is administratively easier is how a salary schedule ends up in an answer about procurement.",[15,79,80,83,84,89],{},[18,81,82],{},"Fetch from the system of record, not the convenient copy."," The extract, the warehouse table, the export somebody set up years ago — those carry their own scoping, usually looser and undocumented, and they are stale in ways the answer will not mention. This is an accuracy argument as much as a security one, and it is the same argument ",[85,86,88],"a",{"href":87},"\u002Fblog\u002Fwhy-enterprise-ai-is-an-architecture-problem","enterprise AI makes as an architecture problem",".",[29,91,93],{"id":92},"injection-what-actually-reduces-the-risk","Injection: what actually reduces the risk",[15,95,96],{},"Assume the hostile string arrives. Rank the mitigations by whether they survive an adversary who knows they are there.",[15,98,99,102,103,89],{},[18,100,101],{},"Weak, and widely sold as strong."," Instructing the model to ignore instructions found in content. This is a request, made in the same channel as the attack, to a component that cannot verify origin. It raises the effort slightly. It is not a boundary, for the same reason ",[85,104,106],{"href":105},"\u002Fblog\u002Fthe-enterprise-ai-control-layer","an instruction is not a control",[15,108,109,112],{},[18,110,111],{},"Weak on its own."," Filtering input for injection-shaped text. Detection of an open-ended natural-language pattern is an arms race you do not win, and the false-negative you care about is the one written by someone who read your filter.",[15,114,115],{},[18,116,117],{},"Genuinely effective, in rough order of strength.",[119,120,121,128,134,140,150],"ul",{},[122,123,124,127],"li",{},[18,125,126],{},"Least privilege on the credential."," The single highest-value control, because it bounds every attack at once rather than any one of them. An agent that cannot reach the payments API cannot be talked into using it.",[122,129,130,133],{},[18,131,132],{},"A choke point that is not a model."," Every consequential action passes through code that evaluates policy, thresholds and limits deterministically. The model proposes; something that cannot be persuaded disposes.",[122,135,136,139],{},[18,137,138],{},"Human approval for the irreversible."," Not for everything — an approval queue nobody has time to work is worse than none, because it launders responsibility. For the actions where being wrong cannot be undone.",[122,141,142,145,146,149],{},[18,143,144],{},"Separating trusted from untrusted context."," Decide ",[65,147,148],{},"before"," retrieval which content may influence which actions. The common pattern that works: content from outside the company may inform an answer but may never be the basis for a tool call that writes.",[122,151,152,155],{},[18,153,154],{},"Rate and volume limits."," Most damaging incidents are not one clever action; they are the same wrong action four thousand times before anyone looked. A cap on actions per window turns a catastrophe into a ticket.",[15,157,158,159,89],{},"That ordering is not just my opinion of it. The 2026 OWASP list ranks injection first on the practitioner vote while the raw incident record drops it out of the top ten entirely — a defence effect, not an absence of risk, and the same argument as above read from the other end. ",[85,160,162],{"href":161},"\u002Fblog\u002Fowasp-llm-top-10-2026-for-enterprise-finance","The full ten, and what moved",[164,165,166],"pull-quote",{},[15,167,168],{},"Injection is not the vulnerability. The vulnerability is an agent whose credential makes a successful injection worth attempting.",[29,170,172],{"id":171},"tools-are-the-actual-attack-surface","Tools are the actual attack surface",[15,174,175,176,89],{},"The model is not where the danger is. The danger is the set of functions you handed it, and the transitive closure of what those functions can reach — a point that follows directly from ",[85,177,179],{"href":178},"\u002Fblog\u002Fhow-ai-agents-fit-into-existing-enterprise-systems","where the agent sits relative to your systems",[15,181,182],{},"Four rules I would hold to, all of them borrowed unchanged from interface design:",[15,184,185,188,189,193],{},[18,186,187],{},"One tool, one verb, one scope."," A tool called ",[190,191,192],"code",{},"update_record"," that takes a table name is not a tool, it is a database session. Narrow tools are auditable and revocable; broad ones are neither.",[15,195,196,199],{},[18,197,198],{},"No tool composes into a wider one by accident."," Read-supplier plus write-payment-instruction is a payment capability, whatever the individual descriptions say. Review the set, not the items.",[15,201,202,205,206,210],{},[18,203,204],{},"Every tool call is a logged event with its inputs."," At the grain of the call, not a summary. This is ",[85,207,209],{"href":208},"\u002Fblog\u002Faudit-trails-and-logging-treasury-systems","audit trails and logging"," applied to a caller that acts far faster than a person and whose reasoning is not recoverable afterwards unless you captured it.",[15,212,213,216],{},[18,214,215],{},"Idempotency on anything that writes."," Agents retry. Retries duplicate. A duplicated payment instruction is a bad afternoon.",[29,218,220],{"id":219},"the-identity-problem-and-the-leaver-nobody-removes","The identity problem, and the leaver nobody removes",[15,222,223,224,228],{},"Agent identity deserves its own treatment and gets it in ",[85,225,227],{"href":226},"\u002Fblog\u002Fagent-identity-and-permissions","who is the AI acting as",". The security-specific point is narrower and it is about revocation.",[15,230,231,232,236],{},"Enterprise access management is a lifecycle, not a launch task — that is ",[85,233,235],{"href":234},"\u002Fblog\u002Faccess-management-and-user-provisioning-treasury","the lesson provisioning keeps reteaching",". A person joins, moves and leaves, and each of those triggers something. A standing agent identity triggers nothing. It does not change roles, does not go on leave, does not resign, and is not on any report the access review reads. It accumulates the permissions each new use case needed and never gives one back.",[15,238,239],{},"Two practical consequences. First, agent identities need a review cadence of their own, because they will not appear in the human one. Second, revocation must be tested, not assumed: if disabling the identity leaves outstanding tokens valid for another hour, then \"we can turn it off\" is a statement about the console rather than about the system.",[29,241,243],{"id":242},"what-defence-in-depth-looks-like-here","What defence in depth looks like here",[15,245,246,247,251],{},"The pattern is the one ",[85,248,250],{"href":249},"\u002Fblog\u002Fpayment-fraud-prevention-in-treasury","payment fraud prevention"," already uses: layers that each assume the previous one failed.",[253,254,255,268],"table",{},[256,257,258],"thead",{},[259,260,261,265],"tr",{},[262,263,264],"th",{},"If this fails",[262,266,267],{},"This still holds",[269,270,271,280,288,296,304],"tbody",{},[259,272,273,277],{},[274,275,276],"td",{},"The model is persuaded by hostile content",[274,278,279],{},"Its credential cannot reach the sensitive system",[259,281,282,285],{},[274,283,284],{},"The credential is wider than intended",[274,286,287],{},"The action hits a deterministic policy check",[259,289,290,293],{},[274,291,292],{},"The policy check has a gap",[274,294,295],{},"The action is irreversible, so it needs a human",[259,297,298,301],{},[274,299,300],{},"The human approves too fast",[274,302,303],{},"Volume limits cap the damage per window",[259,305,306,309],{},[274,307,308],{},"Everything fails",[274,310,311],{},"Event-grain logs make it reconstructable, and a stop control exists",[15,313,314],{},"Read that table as a design brief rather than a maturity model. You do not need all five to start; you need to know which ones you have, so the conversation about the missing rows happens before go-live rather than after an incident.",[15,316,317],{},"And a caution I would put in writing on any design review: the control people are most confident about is usually the one they have never tested. Ask when the stop control was last exercised, and on what.",[29,319,321],{"id":320},"what-i-would-decide","What I would decide",[15,323,324,325,329],{},"Give the agent its own identity, scoped to the task and not to the user's accumulated entitlements. Route every consequential action through code rather than through persuasion. Decide which context is untrusted before you retrieve it, not after. Log at the grain of the call. Cap volume. Put a human on the irreversible things and give them enough time to actually be one — because an oversight step nobody can exercise is the failure mode ",[85,326,328],{"href":327},"\u002Fblog\u002Feu-ai-act-high-risk-requirements-finance-systems","the AI Act's human oversight requirement"," will eventually ask you to evidence.",[15,331,332],{},"None of that prevents injection. All of it makes injection an incident report rather than a loss.",[15,334,335],{},[65,336,337,338,341,342,89],{},"See also ",[85,339,340],{"href":105},"the enterprise AI control layer"," and ",[85,343,345],{"href":344},"\u002Fblog\u002Fdesigning-the-exception-path","designing the exception path",{"title":347,"searchDepth":348,"depth":348,"links":349},"",2,[350,351,352,353,354,355,356],{"id":31,"depth":348,"text":32},{"id":56,"depth":348,"text":57},{"id":92,"depth":348,"text":93},{"id":171,"depth":348,"text":172},{"id":219,"depth":348,"text":220},{"id":242,"depth":348,"text":243},{"id":320,"depth":348,"text":321},"security",null,true,"2026-08-19","An agent that reads untrusted content can be instructed by it. What the boundaries are, which of them hold under pressure, and which are theatre.",false,"md",[365,368,371,374],{"question":366,"answer":367},"Can prompt injection be prevented in an enterprise agent?","Not reliably, and a design that depends on preventing it is the design to worry about. Instruction and data arrive through the same channel, so a model has no dependable way to tell a supplier's invoice text from a command. What you can do is make a successful injection uninteresting: give the agent an identity that can only reach what this task needs, route every consequential action through something that is not a language model, and require a human for anything irreversible. Treat injection as certain and design for the blast radius, the same way payment controls assume someone will eventually try.",{"question":369,"answer":370},"What can an AI agent read that a person could not?","Usually the same documents, but with an important difference in practice. Enterprise content permissions were designed around the assumption that a person has to know where to look and has limited hours. An agent has neither limit, so a permission set that was theoretically over-broad and practically harmless becomes genuinely over-broad the moment something can read all of it and answer questions about it. The exposure is rarely a new leak; it is an old one that nobody could exploit at scale until now.",{"question":372,"answer":373},"How do you revoke an AI agent's access in an incident?","Test it before you need it, because revocation is the control most likely to be assumed rather than verified. Disabling an identity in a console does not necessarily stop work already in flight: outstanding tokens may stay valid for their remaining lifetime, a queued job may carry credentials it obtained earlier, and a cached session may survive the change. Establish what actually stops within what window, and make sure at least one control — a rate limit, a policy check, a required approval — sits in the path independently of the identity, so revocation is not the only thing standing between you and a running incident.",{"question":375,"answer":376},"What is trusted versus untrusted context for an AI agent?","Trusted context is content whose origin you control and whose integrity you can assert: your own prompt, your policy text, a record you fetched from a system of record. Untrusted context is everything that entered from outside — an email body, a supplier PDF, a web page, a document a user uploaded, and in most designs the output of another agent. The distinction matters because the model cannot make it for you. It has to be made in the surrounding system, by deciding what content is allowed to influence what actions, before the content is read rather than after.",{},8,2.8,"\u002Fblog\u002Fenterprise-ai-agent-security-boundaries","enterprise-ai-systems","enterprise AI agent security",217,"Trigger-based: re-verify whenever a major model or agent platform changes its tool-permissioning or context-isolation model. The mitigations here are design-level and durable; specific product behaviour is not, and this page deliberately names no product.","editorial","reviewed","Tan Gravam","informational",{"title":5,"description":361},"blog\u002Fenterprise-ai-agent-security-boundaries",[392,393,357],"enterprise-ai","ai-agents","text","XBXQfFJzj16FjIHpVGGAKodUv876GuNhxAVEJERi4Os",{"related":397,"prev":410,"next":412,"hasOrder":359,"place":415},[398,402,406],{"path":399,"title":400,"description":401},"\u002Fblog\u002Fcan-an-ai-agent-approve-its-own-payment","Can an AI Agent Approve Its Own Payment?","It is not a new question. It is a release strategy — and the per-transaction limit everyone reaches for is the one an agent defeats first.",{"path":403,"title":404,"description":405},"\u002Fblog\u002Fai-output-contracts-and-failure-handling","AI Output Contracts and Failure Handling","A model will return the wrong shape, or a confident lie. How to design output contracts, validation and fallbacks so an enterprise process fails safely.",{"path":407,"title":408,"description":409},"\u002Fblog\u002Fai-evaluation-and-regression-testing","Enterprise AI Evaluation & Regression Testing","How to build eval sets for AI running inside an enterprise — cases, scoring, a regression gate — so a prompt or model change is judged on evidence, not vibes.",{"path":226,"title":411,"type":394,"language":358},"Agent Identity: Who Is the AI Acting As?",{"path":413,"title":414,"type":394,"language":358},"\u002Fblog\u002Ffour-eyes-and-segregation-of-duties-for-ai-agents","Four-Eyes and Segregation of Duties for AI Agents",{"label":416,"position":417,"total":418,"hub":419},"Security",1,3,"\u002Ftopics\u002Fenterprise-ai-systems",[],1787169868004]