Products / 02
Agent Security
An emerging direction: a control plane that gives agents an identity, governs their memory, mediates their tools and makes all of it visible to a SOC.
Research and prototype. There is no Agent Security product available today, and no date is announced.
Overview
An agent with persistent memory, tool access and its own identity is a principal that reasons over untrusted content and then acts with legitimate credentials. The security question is not whether the model can be tricked — it can — but where privilege is exercised, what governs it at that point, and what an investigator would be able to reconstruct afterwards.
The prototype places a control plane around the agent runtime rather than beside it, and treats memory as governed data: provenance attached at write, policy evaluated at recall, every decision recorded. Tool invocation passes a gate that can allow, require review, or quarantine. All of it emits into a conventional SIEM rather than a parallel console.
Lifecycle
Where this sits, and where it does not.
- 01
Research
Published and ongoing work on agent memory as a security boundary, runtime policy and agent observability.
- 02
Prototype
A working control plane running in the KOR IT LAB: identity, memory provenance, tool mediation and telemetry, exercised against a real agent workload.
- 03
Engagement
The architecture delivered as engineering work under AI & Agent Security services, built into a client's own estate.
- 04
Product
Not started. Whether this becomes a product depends on whether the prototype holds up outside the lab.
Architecture
A control plane around the agent.
This is the prototype architecture running in the KOR IT LAB, and the architecture delivered as engineering work today.
The problem
Conventional application security assumes the code path is the attack surface. For agentic systems the attack surface is the content the system reads, and the exploit is a decision rather than a memory corruption. That difference breaks the assumptions detection is built on.
- The malicious action is performed by a sanctioned identity, through a sanctioned tool, in an unremarkable session.
- Where persistent memory is involved, the causal write may sit days or weeks outside any correlation window.
- Agent identity collapses provenance: every downstream action shares one principal.
- Nothing in the sequence is anomalous in isolation — the anomaly is a relationship no pipeline currently joins.
Capability areas
What the research and prototype cover. None of this is purchasable today.
- Agent inventory
- MCP and tool inventory
- Memory security and provenance
- Runtime policy
- Human approval gates
- Agent identity
- AI and agent observability
- Behavioural detection
- Telemetry and SIEM integration
Relationship to KOR IT
Agent Security sits at the far end of the KOR IT pipeline: research produced the questions, the LAB produced a prototype, and services deliver the architecture into client estates today. Whether it becomes a product is an open question, and this page will say so until that changes.
The Memory Contract Specification — the idea that runtime policy contracts could govern whether a memory is allowed to influence an agent at all — is the most speculative part of the work. It is experimental research, not an industry standard and not a commercial offering.