Solutions / 03
Secure Agentic AI
A control plane around autonomous agents: identity, memory governance, tool policy gates and telemetry a SOC can actually use.
The problem
An agentic system concentrates three properties that security architecture normally keeps apart: it reasons over untrusted content, it holds durable state across sessions, and it acts through tools using a legitimate identity. Any one of these is manageable. Together they produce a principal whose behaviour is influenced by data it read and whose actions are indistinguishable from authorised work.
Persistent memory sharpens the problem. The write and its effect are separate events, potentially far apart in time, under different users and in a different tool context. An attacker does not need to be present when the payload fires — only to arrange, once, for content the agent will later treat as its own recollection.
Architecture
What the system looks like.
Six control surfaces sit around the agent runtime. Each is a place where an ordinary security question can be asked and answered: who is this, what may it reach, what may it remember, what may it do, what did it read, and what would we see afterwards.
- Identity
- The agent has its own principal, distinct from the user it acts for and from the services it calls. Delegation is explicit and scoped, so downstream systems can tell an agent action from a human one.
- Memory
- Every stored record carries provenance — origin, authoring context, trust level. Policy is evaluated at recall, not only at write, so low-trust content cannot silently reach a high-privilege reasoning path.
- Tools
- Tool and MCP registration is inventoried and versioned. Each tool has a declared privilege level, and calls pass a policy gate that can allow, require review, or quarantine.
- Policy
- Runtime rules expressed against the properties above — trust level, scope, tenant, TTL, action impact — and evaluated per call rather than per deployment.
- Data
- What the agent may read and where its outputs may land, enforced with the same classification the rest of the estate uses.
- Telemetry
- Retrieval, tool invocation, policy decisions and approvals emitted as security events into the SIEM. Recall becomes a first-class, queryable event rather than an implicit step.
Capabilities
- Agent, tool and MCP inventory with declared privilege levels
- Distinct agent identity with scoped, explicit delegation
- Memory provenance on write and policy evaluation at recall
- Tool policy gates with allow / review / quarantine outcomes
- Human approval flow for actions above a defined impact threshold
- Agent telemetry emitted into the existing SIEM
- Behavioural detection content for agent activity
- Drift monitoring on agent behaviour over time
Security controls
- Untrusted content is labelled as such and its trust level travels with it
- Recall authorisation is evaluated against the privilege of the current task
- Tool calls are authorised per invocation, not per session
- Every policy decision — including allow — is recorded
- Approvals are attributed to a named person and bound to a specific action
- Memory mutation and deletion are themselves audited operations
Integration approach
The control plane is designed to sit in front of agent runtimes rather than to replace them, and to emit into the SIEM a SOC already operates rather than to introduce a parallel console. Adoption usually begins with inventory and telemetry, because most organisations cannot yet answer what agents they run — and that answer is a prerequisite for every control that follows.
- Inventory agents, tools, MCP servers, memory stores and the identities in use.
- Emit telemetry for retrieval, tool calls and policy decisions into the SIEM.
- Separate agent identity from user identity and scope delegation explicitly.
- Attach provenance and trust level to memory writes.
- Introduce policy gates at the tool boundary, starting in review-only mode.
- Enable recall-time policy and human approval on the highest-impact paths.
Expected outcomes
- A list of the agents you actually run, and what each can reach
- Agent activity visible to the SOC in its existing tooling
- Memory that carries its own provenance into the moment it is used
- Tool privilege enforced per call, with the decision recorded
- A defensible position on which actions require a human
Limitations
Recall-time policy adds latency, and the trade-off between policy granularity and agent usefulness is real and unresolved. Behavioural detection for agents is early work: we can describe what should be observable, but published detection efficacy figures for agent behaviour do not yet exist, ours included.