Agentic AI and Cyber Resilience: A Control Architecture for Institutions

Agentic AI changes the cybersecurity problem because software can move from producing information to selecting tools, calling services and initiating actions. The security boundary therefore has to extend from the model to the identities, permissions, data paths and tools around it.

The attack surface is becoming an action surface

Traditional AI security often focuses on model theft, data leakage, prompt injection and malicious inputs. Agentic systems add another layer: a compromised, manipulated or misconfigured system may have the ability to invoke APIs, modify records, move data, generate code, trigger workflows or act through privileged software identities.

Autonomy compresses security decision time

AI-assisted reconnaissance, automated tooling and machine-speed workflows can reduce the time available for detection and containment. Institutions should therefore assume that some failures will propagate faster than conventional manual review and design controls that constrain authority before execution.

Seven controls for the agentic enterprise

1. Persistent machine identity

Every material agent should have a distinguishable identity associated with an accountable owner, approved purpose, environment, credentials and audit history.

2. Least-privilege tool access

Agents should receive only the tools and permissions required for the approved task. High-impact actions should require stronger authorization or human confirmation.

3. Segmented secrets and credentials

Credential storage, token issuance and secret access should limit blast radius if an agent, tool or orchestration layer is compromised.

4. Controlled context

Retrieval sources, memory, external content and user-supplied context should be treated as potentially untrusted inputs. Provenance and sanitization matter because context can influence downstream action.

5. Policy-enforced action gates

Technical policy should constrain what the agent may execute, where it may act and when approval is required rather than relying only on natural-language instructions.

6. Full-path observability

Logs should capture model requests, tool selection, permissions, external calls, data access, decisions, errors and resulting actions sufficiently to support investigation and accountability.

7. Revocation and containment

Organizations need the ability to disable an agent, revoke credentials, isolate workflows and roll back or contain actions when behavior becomes unsafe or compromised.

Secure by design applies to the agent stack

Secure-AI guidance from CISA and international partners places security across design, development, deployment and operation. For agentic systems, the secure default should be constrained authority, strong identity, explicit trust boundaries and observable behavior rather than broad permissions granted for convenience.

Operating-model implications

Agentic AI makes cybersecurity, AI governance and enterprise architecture converge. Security teams require approved use cases and accountable owners; governance teams require telemetry and enforceable controls; architecture teams require coherent identity, authorization and containment layers.

Institutional outlook

The institutions best positioned for agentic AI will be those that create a reusable control plane for machine identity, permissions, policy, observability and containment so that higher levels of autonomy can be introduced without loss of institutional control.