AI safety is an engineering problem; it requires defined requirements, actionable controls, accountable people, and evidence that safeguards are working. As capabilities increase, access to defensive tools should be expanded and effective practices shared more quickly.
Although the internet and cloud computing change, core responsibilities such as authentication, access control, limiting exposure, and verifying safeguards remain. AI agents that reason, use tools, and adapt based on data require these principles to be applied under new conditions.
Agent security depends on jointly protecting the model, the harness that manages its context and workflows, the runtime environment, code, data, identity, services, and infrastructure. For example, a network policy should block an agent attempting to send customer data to an unauthorized destination through a malicious instruction; protected logs should show the tool call, authorization decision, and outcome. Permission to update records does not grant export authorization; the agent cannot approve additional access itself.
The runtime environment should independently enforce file, network, and process boundaries. Agents should have traceable identities, task-limited credentials, clear access policies, and human approval. The source and integrity of tools should be verified; procedures for revoking access and containing incidents should be prepared. NVIDIA OpenShell is an open-source, protected runtime environment that enforces policies outside the agent.
Why it matters
This framework shows that evaluating AI agents solely based on the outputs they produce may be insufficient; the risk extends from the tools the agent uses and the data it accesses to the environment in which it operates. For this reason, developers, system administrators, and security teams must distinguish which layer is responsible, while also establishing preventive boundaries rather than merely investigating breaches after the fact. An agent’s inability to turn the authorization granted for a task into another form of access highlights the decisive role of the scope of authorization in security design. The unresolved issue is which criteria will be used to validate these controls across different workflows and how revoking access and containing incidents will be carried out when safeguards fail.
Term: agent
An AI agent is software that calls tools and carries out multi-step tasks to achieve a goal rather than producing a single response.