AI agents change the security boundary because they do more than generate text. A coding agent can read files, execute shell commands, install packages, change repositories, call APIs, and modify cloud resources. Once a model can take actions with real side effects, the core security question is no longer only whether the model produced a bad answer. It is whether a risky action can be stopped before it becomes a system change.
Monitoring and prevention solve different problems. Logs are useful after an action happens. Runtime controls matter before it happens.
OBSERVATION IS NOT ENFORCEMENT
Traditional security stacks are good at collecting evidence. Endpoint tools record processes. SIEMs aggregate events. Agent platforms increasingly expose traces of prompts and tool calls.
But a trace that says an agent just deleted a file is not a control.
NIST has highlighted this shift in its work on AI agent security, including methods to constrain and monitor agent access in deployment environments. OWASP’s 2026 agentic security work similarly treats excessive agency as a core risk. Once an agent has tools and permissions, security has to govern what it can do with them.
The practical control point is the moment between an agent requesting an action and the underlying tool executing it.
PUT POLICY AT THE ACTION BOUNDARY
A useful pre-execution control does not need to understand every thought inside a model. It needs enough structured context to decide whether a requested action should be allowed, blocked, or reviewed.
For a shell command, that may include the command, working directory, and whether the operation is destructive. For a file read, it may include the path and whether the file is likely to contain credentials. For a package install, it may include package provenance and whether a dependency changed unexpectedly.
This creates a cleaner trust boundary than trying to infer intent from a long conversation. The model can still plan freely. The control layer governs the side effect.
FOUR CONTROLS MATTER MORE THAN A BIGGER PROMPT
First, use least privilege at the tool layer. An agent should not inherit every permission a developer has simply because it is running on the developer’s machine. Scope credentials, filesystem access, MCP servers, and cloud permissions to the task.
Second, distinguish reversible from irreversible actions. Reading a public file is different from deleting a directory, pushing to a protected branch, rotating credentials, or sending data externally.
Higher-impact actions should require stronger policy or explicit approval.
Third, treat external content as untrusted input. A webpage, issue, package README, tool response, or retrieved document may contain instructions the model interprets as part of its task. Content acquired during reasoning should not silently become execution authority.
Fourth, preserve an auditable decision trail. For consequential actions, teams should be able to answer what the agent attempted, what policy applied, who approved an exception, and what changed afterward.
THE HARD PART IS COVERAGE, NOT THE DEMO
One lesson from maintaining HOL Guard, our open-source runtime security layer for AI agents and coding tools, is that a control is only as useful as the action surfaces it actually covers.
A policy engine can look impressive in a controlled demo and still leave gaps if an agent can reach the same side effect through an unmonitored path. Shell execution, file access, MCP configuration changes, plugin or skill installs, and external tool calls can have different interception points depending on the agent harness.
Coverage should therefore be explicit. Teams should document which actions are blocked, which require review, which are only observed, and which sit outside the enforcement path. HOL Guard takes this approach for supported coding-agent workflows, but the principle is vendor-neutral: do not confuse visibility into some actions with control over all actions.
There is also a human factor. If every normal command triggers approval, users will learn to approve everything. Good runtime policy should keep routine work fast while adding friction to genuinely sensitive actions.
A PRACTICAL STARTING POINT
Start by inventorying the actions agents can take today. Identify which tools can write files, execute commands, install software, access secrets, change infrastructure, or communicate externally.
Classify those actions by consequence. Define a small set of hard stops for destructive operations, a review tier for ambiguous high-impact actions, and an allow path for routine work.
Place the control as close as possible to execution. Test what happens when the model is wrong, retrieved content is malicious, a plugin changes behavior, or the policy service is unavailable.
Finally, review exceptions. The most useful signal is often not the number of blocks, but the pattern of actions users repeatedly override. That is where policy is either too broad or the workflow needs a safer approved path.
SECURITY HAS TO MOVE FROM THE CONVERSATION TO THE CONSEQUENCE
Prompt security still matters. Model evaluation still matters. Detection still matters. None replaces control over the action that creates the side effect.
As agents gain more autonomy, the durable security boundary is the point where a proposed action becomes a real change to a file, system, account, repository, or external service.
Teams that put policy at that boundary can let agents remain useful without treating every model output as trusted execution authority.
____
Author: Michael Kantor, President of Hashgraph Online (HOL). HOL develops open standards and open-source infrastructure for AI agents. Michael helps maintain HOL Guard (https://hol.org/guard), an open-source runtime security layer for AI agents and coding tools.
Sources:
NIST AI Agent Standards Initiative:
https://www.nist.gov/artificial-intelligence/ai-agent-standards-initiative
NIST AI Agent Security RFI:
OWASP GenAI Security Project 2026 update:
HOL Guard AI coding agent runtime coverage:
https://hol.org/guard/ai-coding-agents
Join our LinkedIn group Information Security Community!
