Notes on governing AI agents.
What we're learning from assessments and from teams putting agents into production.
What Is a Never List for AI Agents?
A never list is a short set of rules an AI agent can't break. Each rule needs an outside check. "No working link, no source" passes that test.
By Michelle Savage
Why Do AI Agents Pass Every Access Check and Still Get It Wrong?
An AI agent can pass every access check and still act on something false. In Josh's Lab, a made-up source ended up in two documents. Check what agents believe.
By Josh Woodruff
How should an AI agent log in to the tools it calls?
Don't give an AI agent a long-lived key. Use short-lived tokens issued at runtime for one tool. Ten client calls in 2026 showed the four-rung path.
By Josh Woodruff
Why Does the AI Mandate Arrive Before Identity Is Ready?
Leaders set AI dates before identity work is done, as 11 client calls showed in 2026. Start agents small with five jobs: record, owner, exit, scope, log.
By Josh Woodruff
How to Evaluate an AI Security Vendor With No Peer References
No peers have run most AI security products yet, so ask vendors for evidence: seven question categories, a proof of value, and a short contract.
By Josh Woodruff
What does segmentation mean for AI agents?
Segmentation limits which systems and agents an AI agent can reach, so one bad decision stays small. Contain the blast radius first.
By Josh Woodruff
What Is the Confused Deputy Problem in AI Agent Gateways?
A gateway that reuses its own login for every downstream call hides which AI agent actually made the call. Token exchange fixes it with a narrow token.
By Josh Woodruff
How do I stop an AI agent before it acts?
You stop an AI agent before it acts with a gate outside the model. Block high-impact actions until policy and a human say yes.
By Josh Woodruff
Which Rules Apply to AI Agents in a Regulated Business?
Almost no rule names AI agents yet. That silence isn't permission. Map every agent onto a control you already report on, and keep the proof.
By Josh Woodruff
What Should a CISO Tell the Board About AI Agents?
The board wants one answer about AI agents: when one goes wrong, can you show you had control. Four things prove it: see it, stop it, trace it, prove it.
By Josh Woodruff
Why Security Teams Are Building Their Own AI Reference Architecture
No complete AI security reference architecture exists to buy. So the strongest security teams build their own and hand it to vendors as a coverage grid.
By Josh Woodruff
Why Your Copilot Pilot Outruns Your Data Classification
Copilot doesn't create a data leak. It reveals the permissions you already had. Nine client calls in 2026 hit the same wall. Classification sets the tier.
By Josh Woodruff
Why Your Security Tools Can't See What Your AI Agents Do
Your CASB, EDR, and DLP watch people and devices. AI agents call tools through MCP, which looks like normal web traffic, so their calls slip past unseen.
By Josh Woodruff
Why Your Security Team Should Govern Its Own AI Agents First
Your security team is likely the first team running AI agents in production. Seven client calls in summer 2026 showed the same shape. Govern those agents first.
By Josh Woodruff
Where Should Deterministic Code End and the LLM Begin?
Two teams in unrelated industries drew the same line independently. The useful question isn't whether to use AI. It's which parts stay deterministic.
By Josh Woodruff
Where Does the Human Sit in an Agentic SOC?
"Human in the loop" means little when an agent acts in milliseconds. What works instead is an authority ladder that sorts actions by what they cost to undo.
By Josh Woodruff
Where Do You Stop an AI-Suggested Software Install?
Put the control where the command runs, not in the AI tool. Tenant settings stop at the copy button. Enforce on the endpoint and at the network exit.
By Josh Woodruff
Why Does Your AI Review Board Only See Finished Work?
AI review boards fire on intake, and AI work never arrives through intake. Move the trigger earlier and register intent before any code exists.
By Josh Woodruff
How Does a Small Security Team Govern AI?
Extend what you already run instead of building a separate AI security program. Treat AI as a change to identity, data, software delivery, and network access.
By Josh Woodruff
Your AI Policy Is Live. Your Enforcement Isn't.
Most AI governance programs have a committee, a policy, and published requirements. What they lack is anything that stops an app from ignoring all three.
By Josh Woodruff
What Does It Mean to Approve an AI Agent?
Security gets named as the AI agent approver without anyone defining what approval means. Five written questions beat a committee that takes months.
By Josh Woodruff
Every AI Agent Needs One Accountable Human
Put one named person on every AI agent, or the program stalls. An agent can't be held accountable for anything. The person who turned it on can.
By Josh Woodruff
Contain First, Count Second: AI Agent Blast Radius
Contain the damage before you finish the inventory. Blast-radius controls work against the AI agents you haven't found yet, and discovery never finishes.
By Josh Woodruff
Who Approves the Code Your AI Agent Just Wrote?
Coding agents came up on eleven security calls in seven months. Only two of those calls were about coding agents on purpose. The rest were discoveries.
By Josh Woodruff
Security Teams Now Ask About MCP Before They Deploy It
Sixteen security teams asked about the Model Context Protocol in seven months. The first wanted a definition. The latest already had servers running.
By Josh Woodruff
Why AI ROI Metrics Miss the Cost of Ungoverned Agents
Popular AI ROI frameworks measure revenue, cost, speed, and adoption. None of them measure risk. That missing column is what breaks the business case.
By Josh Woodruff
Why Authorized AI Agent Actions Still Add Up to an Attack
Agent risk is a chain of approved actions nobody scoped together. Every step passes its check. The sequence is the attack.
By Josh Woodruff
How Do You Govern AI Agents That Disappear in Minutes?
You can't govern AI agent copies. They vanish in minutes. Govern the blueprint they're stamped from, and put its tool scope in Git.
By Josh Woodruff
What Can Your AI Agent Access Right Now?
Ask what your AI agent can access, not what it can do. Access sets your blast radius. If nobody can answer in ten minutes, that's the finding.
By Josh Woodruff
AI Agent Identity Isn't Enough: How to Run a Belief Audit
Identity proves who your AI agent is. It can't prove what your agent believes is true. That's the audit almost nobody has run.
By Josh Woodruff
Your AI Security Controls Get Bypassed When They Block Real Work
AI security controls that block real work get bypassed, even by your best people. The fix is an approved path that lets safe work flow and stops the unknown.
By Josh Woodruff
The Two-Question Test for AI Agents: Can You Shut It Off, and Can You Undo It?
Before any AI agent goes live, ask two questions: can you shut it off instantly, and can you undo what it did? If either answer is no, it isn't ready.
By Josh Woodruff
Can You Undo What Your AI Agents Did Last Night?
The best AI builders stopped trying to trust their agents. The new audit question is whether you can undo what your agents did last night.
By Josh Woodruff
AI Agent Sprawl: Why You Can't Control the AI Agents You Never Counted
AI agent sprawl is when a company runs more AI agents than it can count or shut off. Most firms can't say how many they run. The fix starts with one list.
By Josh Woodruff
How Do You Give an AI Agent the Right Amount of Access?
A bank's AI agent taught itself to reverse fees and gave away $1.2 million, all with access it was never meant to use. Right-sizing agent access prevents this.
By Josh Woodruff
What Is Zero Trust for AI Agents, in Plain English?
Zero Trust is one idea: never trust, always verify. For AI agents, being inside your network earns no free pass. Every action must still prove itself.
By Josh Woodruff
What Is Data Poisoning, and How Do You Keep It Out of Your AI Agents?
Data poisoning corrupts an AI agent from the inside. The dashboards stay green while the decisions go wrong. One firm lost $100K before anyone noticed.
By Josh Woodruff
What Is a Kill Switch for AI Agents, and How Do You Build One?
When an agent goes wrong, seconds count. A kill switch stops the damage. One team found their backup switch had a 45-second delay, an eternity at machine speed.
By Josh Woodruff
What Is an AI Agent, and How Is It Different From a Chatbot?
A chatbot gives you an answer. An AI agent takes an action. That one difference changes everything about how you manage, trust, and secure it.
By Josh Woodruff
What Is Prompt Injection, and How Do You Protect AI Agents From It?
Prompt injection is social engineering for AI. Someone slips your agent hidden instructions and it obeys. One bot got talked into selling a car for $1.
By Josh Woodruff
How Do You Monitor an AI Agent's Behavior?
You can't tell a compromised agent from a busy one unless you know its normal. One pricing agent crept its margins up for six weeks before anyone caught it.
By Josh Woodruff
How Do You Respond When an AI Agent Goes Rogue?
When an AI agent goes wrong you have minutes, not months. Traditional breach response averages 258 days, but agent decisions compound every second.
By Josh Woodruff
Is AI Agent Regulation Already Here, and What Does It Cost?
The EU AI Act can fine violators up to 35 million euros or 7% of global revenue, whichever is higher. AI agent regulation isn't coming. It's already here.
By Josh Woodruff
Why Are AI Agents Already Outnumbering Your Employees?
Automated accounts already outnumber people 10 to 1, and up to 92 to 1 in some companies. By 2030, humans could be the minority in your systems.
By Josh Woodruff
What Should Your First 90 Days of Agentic AI Look Like?
Deploy your first AI agent in 90 days without a disaster: find your hidden AI, pick one contained use case, and build boundaries in from day one.
By Josh Woodruff
What Is the Agentic Trust Framework for Securing AI Agents?
The Agentic Trust Framework turns Zero Trust into five working controls for AI agents: identity, behavior, data, segmentation, and incident response.
By Josh Woodruff
Why Enterprise AI Projects Fail: Studies Disagree on Numbers, Not the Reason
Two studies on enterprise AI reached opposite conclusions. Both are right. The real reason projects fail is the gap between the demo and the rollout.
By Josh Woodruff
An AI Agent Opened 12 Accounts Over the Weekend. Nobody Approved One.
An AI agent opened 12 accounts over a weekend with no approval. Here's why it's not a hack, and how to find the ungoverned agents in your business.
By Josh Woodruff
Governing AI Agents: A Three-Layer Architecture
The first formal conformance assessment against the Agentic Trust Framework, and the three-layer architecture behind it: framework, runtime, protocols.
By Josh Woodruff
How to Tell What Level Your AI Agents Are Actually Running At
AI agents run at four levels: intern, junior, senior, principal. Most get installed too high on day one. Here's how to find each one's real level.
By Josh Woodruff
How Should You Govern a New AI Agent? Start It as an Intern.
Govern a new AI agent like a new hire. Give it an identity it can't fake, log every move, and grant access in stages it has to earn. Start it as an intern.
By Josh Woodruff
What is agent washing? (And how to spot fake agentic AI vendors)
Gartner says only ~130 of thousands of agentic AI vendors are real. The rest are rebadged chatbots and RPA. How to spot the fakes before your audit does.
By Josh Woodruff
Are AI agents the same as non-human identities (NHIs)?
AI agents are NHIs, technically. Silverfort and Strata say treating them that way is breaking security. Why agents need controls NHIs don't.
By Josh Woodruff
What Auditors Actually Want To Know About AI Agents
One security team found 600 AI agents it never approved. The auditor's call is coming. Here are the 5 questions every CISO needs to answer.
By Josh Woodruff
What is the AI agent identity problem?
Only 18% of security leaders trust their identity systems for AI agents (Strata, May 2026). The five-element blueprint that fixes pilot purgatory.
By Josh Woodruff
What Will Your Auditor Ask About AI Agents Before the August 2026 EU Deadline?
Meta's March 18, 2026 AI agent incident exposed the audit gap. California closed the AI defense in January. EU enforcement begins August 2. What to do now.
By Josh Woodruff
The 50-Term AI Agent Governance Glossary Every Security Leader Needs
Most agent governance conversations stall on vocabulary. The new 50-term plain-language glossary fixes that. Free, dated, citable.
By Josh Woodruff
What Questions Should You Ask Before Deploying an AI Agent?
Four questions, thirty minutes, written down. That's the minimum governance before any AI agent touches production.
By Josh Woodruff
What Is Shadow AI and Why Did RSAC 2026 Call It the Top Security Threat?
RSAC 2026 gave its top award to a tool that finds AI agents you don't know you have. Here's what that means for your organization.
By Josh Woodruff
Why Zero Trust Needs More for AI Agents (and How to Fix It)
Zero Trust was designed for humans logging into systems. AI agents don't log in...they act, chain decisions, and call systems continuously. Here's what to do.
By Josh Woodruff
What Is Trusted Agents? AI Agent Security for Business Leaders
Trusted Agents is a free weekly newsletter on AI agent security for business leaders. Real incidents, action plans, and Zero Trust gap analysis every Tuesday.
By Josh Woodruff
What are CISOs saying about AI agents in 2026?
Ditch the vendor hype. Here is what CEOs and CISOs are actually saying about AI agent deployment, security risks, and the 95% failure rate in 2026.
By Josh Woodruff
Zero Trust for AI Agents: Why Your Identity Model is Obsolete
You solved Zero Trust for humans. Now it's time for AI agents. Learn the 5 principles to extend your security framework to the autonomous future.
By Josh Woodruff
84% of Companies Would Fail an AI Agent Audit. Would Yours?
A new CSA survey found 84% of organizations would fail a compliance audit on AI agent behavior. Here's why, and what to do about it this week.
By Josh Woodruff
Why Do 95% of Enterprise AI Projects Fail? (And What the 5% Do Differently)
Goldman Sachs projects $200 billion in AI investment. MIT research shows 95% of AI pilots fail completely. Here's what separates the companies that succeed.
By Josh Woodruff
That 'Temporary' Permission You Gave Your AI Agent Is Still There
That 'temporary' access you gave your AI 8 months ago? Time to audit those permissions!
By Josh Woodruff
Your Team Already Has AI Agents (It’s Time To Find Them)
The average company has 5-15 'shadow AI' agents running right now. Your grammar checker? AI agent. Meeting scheduler? AI agent. Time to find them all.
By Josh Woodruff
Take This Quiz Before You Spend a Dollar on Agentic AI
Before you spend money on AI, take this 10-minute readiness assessment. You’ll be happy you did.
By Josh Woodruff