report.object
AI agent security, identity and permissions
Expert-reviewed from public records, platform data, primary sources, and private research beyond AI search. Use /api/v1/reports/RPT_01KSKSECAGENTIDPERMS01/sample before purchase, then download PDF, JSON, or Markdown after checkout.
page.markdown
AI agent security, identity and permissions.md
# AI agent security, identity and permissions
Agent risk now sits in identity and delegated authority. Buyers should approve the credentialed route, not the agent brand, before write access, browsing, code execution or MCP tools move into production.
## Object
| field | value |
| ---------------- | -------------------------- |
| report_id | RPT_01KSKSECAGENTIDPERMS01 |
| schema_version | 2026-05-28 |
| last_updated_at | 2026-06-13 |
| category | AGENTS |
| sector | Technology |
| region | GLOBAL |
| confidence_score | 0.89 |
| source_count | 70 |
| evidence_count | 81 |
## Endpoints
| action | endpoint |
| ------------ | ----------------------------------------------------- |
| summary | /api/v1/reports/RPT_01KSKSECAGENTIDPERMS01 |
| sample | /api/v1/reports/RPT_01KSKSECAGENTIDPERMS01/sample |
| schema | /api/v1/reports/RPT_01KSKSECAGENTIDPERMS01/schema |
| quote | /api/v1/reports/RPT_01KSKSECAGENTIDPERMS01/quote |
| purchase | /checkout/RPT_01KSKSECAGENTIDPERMS01?view=agent |
| versions | /api/v1/reports/RPT_01KSKSECAGENTIDPERMS01/versions |
| changelog | /api/v1/reports/RPT_01KSKSECAGENTIDPERMS01/changelog |
| monitor | /api/v1/monitors?report_id=RPT_01KSKSECAGENTIDPERMS01 |
| mcp_resource | colophon://reports/RPT_01KSKSECAGENTIDPERMS01/sample |
## Coverage
| field | value |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| category | AGENTS |
| sector | Technology |
| region | GLOBAL |
| topics | AI agent security, agent identity, agent permissions, non-human identity, MCP security, A2A protocol, OAuth delegation, tool guardrails, prompt injection, workload identity, agent audit logs, agent procurement |
| source_classes | security_framework, protocol_specification, security_standard, identity_standard, government_framework, government_security_standard, threat_model_framework, industry_survey, identity_platform_docs, cloud_agent_docs, security_guidance, agent_platform_docs, security_research, workload_identity_standard, agent_framework_docs, model_system_card, agent_index, agent_benchmark, government_security_guidance, research_paper, cloud_docs, conference_schedule |
| update_cadence | Weekly |
## Sample JSON
```json
{
"report_id": "RPT_01KSKSECAGENTIDPERMS01",
"slug": "ai-agent-security-identity-permissions",
"schema_version": "2026-05-28",
"title": "AI agent security, identity and permissions",
"abstract": "Agent risk now sits in identity and delegated authority. Buyers should approve the credentialed route, not the agent brand, before write access, browsing, code execution or MCP tools move into production.",
"category": "AGENTS",
"sector": "Technology",
"region": "GLOBAL",
"topics": [
"AI agent security",
"agent identity",
"agent permissions",
"non-human identity",
"MCP security",
"A2A protocol",
"OAuth delegation",
"tool guardrails",
"prompt injection",
"workload identity",
"agent audit logs",
"agent procurement"
],
"last_updated_at": "2026-06-13T00:00:00Z",
"source_count": 70,
"evidence_count": 81,
"confidence_score": 0.89,
"web_url": "/r/ai-agent-security-identity-permissions/RPT_01KSKSECAGENTIDPERMS01",
"sample_endpoint": "/api/v1/reports/RPT_01KSKSECAGENTIDPERMS01/sample",
"inventory_endpoint": "/api/v1/reports/RPT_01KSKSECAGENTIDPERMS01/inventory",
"full_endpoint": "/api/v1/reports/RPT_01KSKSECAGENTIDPERMS01/full",
"schema_endpoint": "/api/v1/reports/RPT_01KSKSECAGENTIDPERMS01/schema",
"redaction": {
"status": "sample",
"paid_sections_redacted": true,
"preview_limits": [
"summary",
"table_of_contents",
"evidence_profile"
]
},
"coverage": {
"category": "AGENTS",
"sector": "Technology",
"region": "GLOBAL",
"topics": [
"AI agent security",
"agent identity",
"agent permissions",
"non-human identity",
"MCP security",
"A2A protocol",
"OAuth delegation",
"tool guardrails",
"prompt injection",
"workload identity",
"agent audit logs",
"agent procurement"
],
"source_classes": [
"security_framework",
"protocol_specification",
"security_standard",
"identity_standard",
"government_framework",
"government_security_standard",
"threat_model_framework",
"industry_survey",
"identity_platform_docs",
"cloud_agent_docs",
"security_guidance",
"agent_platform_docs",
"security_research",
"workload_identity_standard",
"agent_framework_docs",
"model_system_card",
"agent_index",
"agent_benchmark",
"government_security_guidance",
"research_paper",
"cloud_docs",
"conference_schedule"
]
},
"confidence": {
"overall_confidence": 0.89,
"source_quality": 0.91,
"source_recency": 0.9,
"source_density": 0.92,
"claim_verifiability": 0.88,
"geographic_coverage": 0.83,
"known_gaps": [
"No public benchmark tests the same route across enterprise IAM, MCP, A2A, browser use, code execution, human approval, rollback and SIEM export.",
"Provider control evidence is uneven and often vendor-controlled, especially for hosted tools, guardrails, sandbox isolation and third-party testing.",
"Public incident evidence is strong enough to define exploit classes, but not enough to rank current product safety without buyer-environment testing.",
"Public pricing evidence does not link specific controls to accepted-action economics, reviewer minutes, rollback cost or trace-export burden.",
"Agent identity standards are converging but not settled; OAuth, workload identity, MCP, A2A and agent-specific identity products still leave portability gaps.",
"Revocation, token expiry, cached tool state and browser session invalidation need buyer-specific drills.",
"Cloud service-agent defaults and managed identity permissions vary by provider and product release.",
"Public evidence is strongest for technology-platform routes; sector-specific legal, healthcare, financial and public-sector controls need companion workflow files."
]
},
"document": {
"object": "report_document",
"schemaVersion": "2026-05-28",
"title": "AI agent security, identity and permissions",
"subtitle": "Approve the credentialed route before the agent gets authority.",
"abstract": "Agent risk now sits in identity and delegated authority. Buyers should approve the credentialed route, not the agent brand, before write access, browsing, code execution or MCP tools move into production.",
"category": "AGENTS",
"sector": "Technology",
"region": "GLOBAL",
"topics": [
"AI agent security",
"agent identity",
"agent permissions",
"non-human identity",
"MCP security",
"A2A protocol",
"OAuth delegation",
"tool guardrails",
"prompt injection",
"workload identity",
"agent audit logs",
"agent procurement"
],
"sources": [
{
"id": "S1",
"label": "OWASP - Top 10 for Agentic Applications",
"publisher": "OWASP GenAI Security Project",
"sourceClass": "security_framework",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "sample",
"publicationDate": "2025-12-09",
"transformChain": [],
"url": "https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/"
},
{
"id": "S2",
"label": "OWASP - Top 10 for Large Language Model Applications",
"publisher": "OWASP",
"sourceClass": "security_framework",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "sample",
"publicationDate": "2025-01-01",
"transformChain": [],
"url": "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
},
{
"id": "S3",
"label": "Model Context Protocol - Authorization specification",
"publisher": "Model Context Protocol",
"sourceClass": "protocol_specification",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "sample",
"publicationDate": "2025-06-18",
"transformChain": [],
"url": "https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization"
},
{
"id": "S4",
"label": "Model Context Protocol - Security best practices",
"publisher": "Model Context Protocol",
"sourceClass": "security_standard",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "sample",
"publicationDate": "2025-06-18",
"transformChain": [],
"url": "https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices"
},
{
"id": "S5",
"label": "IETF RFC 9700 - OAuth 2.0 Security Best Current Practice",
"publisher": "IETF",
"sourceClass": "identity_standard",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "sample",
"publicationDate": "2025-01-01",
"transformChain": [],
"url": "https://www.ietf.org/rfc/rfc9700.pdf"
},
{
"id": "S6",
"label": "IETF RFC 8693 - OAuth 2.0 Token Exchange",
"publisher": "IETF",
"sourceClass": "identity_standard",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "sample",
"publicationDate": "2020-01-01",
"transformChain": [],
"url": "https://www.ietf.org/rfc/rfc8693"
},
{
"id": "S7",
"label": "IETF RFC 9728 - OAuth 2.0 Protected Resource Metadata",
"publisher": "IETF",
"sourceClass": "identity_standard",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "sample",
"publicationDate": "2025-04-01",
"transformChain": [],
"url": "https://www.rfc-editor.org/rfc/rfc9728"
},
{
"id": "S8",
"label": "NIST - AI Risk Management Framework",
"publisher": "NIST",
"sourceClass": "government_framework",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "sample",
"publicationDate": "2023-01-26",
"transformChain": [],
"url": "https://www.nist.gov/itl/ai-risk-management-framework"
},
{
"id": "S9",
"label": "NIST AI 600-1 - Generative AI Profile",
"publisher": "NIST",
"sourceClass": "government_framework",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "sample",
"publicationDate": "2024-07-26",
"transformChain": [],
"url": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf"
},
{
"id": "S10",
"label": "NIST SP 800-207 - Zero Trust Architecture",
"publisher": "NIST",
"sourceClass": "government_security_standard",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "sample",
"publicationDate": "2020-08-01",
"transformChain": [],
"url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf"
},
{
"id": "S11",
"label": "NIST SP 800-63 - Digital Identity Guidelines",
"publisher": "NIST",
"sourceClass": "identity_standard",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "sample",
"publicationDate": "2025-07-31",
"transformChain": [],
"url": "https://www.nist.gov/identity-access-management/projects/nist-special-publication-800-63-digital-identity-guidelines"
},
{
"id": "S12",
"label": "Cloud Security Alliance - Agentic AI IAM",
"publisher": "Cloud Security Alliance",
"sourceClass": "security_framework",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "sample",
"publicationDate": "2025-09-01",
"transformChain": [],
"url": "https://cloudsecurityalliance.org/artifacts/agentic-ai-identity-and-access-management-a-new-approach"
},
{
"id": "S14",
"label": "Cloud Security Alliance - Identity and access gaps in autonomous AI",
"publisher": "Cloud Security Alliance",
"sourceClass": "industry_survey",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "locked",
"publicationDate": "2026-03-24",
"transformChain": [],
"url": "https://cloudsecurityalliance.org/press-releases/2026/03/24/more-than-two-thirds-of-organizations-cannot-clearly-distinguish-ai-agent-from-human-actions"
},
{
"id": "S15",
"label": "Microsoft Entra Agent ID - Manage agent identities",
"publisher": "Microsoft",
"sourceClass": "identity_platform_docs",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "locked",
"publicationDate": "2026-05-01",
"transformChain": [],
"url": "https://learn.microsoft.com/en-us/entra/agent-id/manage-agent-identities-admin"
},
{
"id": "S16",
"label": "Microsoft Foundry - Agent identity concepts",
"publisher": "Microsoft",
"sourceClass": "cloud_agent_docs",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "locked",
"publicationDate": "2026-05-15",
"transformChain": [],
"url": "https://learn.microsoft.com/en-us/azure/foundry/agents/concepts/agent-identity?view=foundry"
},
{
"id": "S24",
"label": "OpenAI Agents SDK - Guardrails",
"publisher": "OpenAI",
"sourceClass": "agent_framework_docs",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "locked",
"publicationDate": "2026-05-01",
"transformChain": [],
"url": "https://openai.github.io/openai-agents-js/guides/guardrails/"
},
{
"id": "S29",
"label": "MIT - 2025 AI Agent Index",
"publisher": "MIT",
"sourceClass": "agent_index",
"accessedAt": "2026-06-13",
"status": "verified",
"access": "locked",
"publicationDate": "2026-05-01",
"transformChain": [],
"url": "https://aiagentindex.mit.edu/data/2025-AI-Agent-Index.pdf"
}
],
"evidence": [
{
"id": "E1",
"sourceId": "S1",
"claimIds": [
"C1",
"C5"
],
"summary": "OWASP's Agentic Top 10 describes goal hijack, tool misuse, identity and privilege abuse, memory poisoning, insecure inter-agent communication, cascading failures and rogue agents as agentic application risks.",
"status": "verified",
"confidence": 0.88,
"access": "sample"
},
{
"id": "E3",
"sourceId": "S3",
"claimIds": [
"C3",
"C4"
],
"summary": "MCP authorization defines HTTP transport authorization around OAuth-style roles, protected resource metadata, authorization server metadata, 401 and 403 error handling, short-lived tokens and PKCE.",
"status": "verified",
"confidence": 0.88,
"access": "sample"
},
{
"id": "E4",
"sourceId": "S4",
"claimIds": [
"C4"
],
"summary": "MCP security guidance warns about token passthrough, confused-deputy and SSRF paths; MCP servers must not accept tokens that were not explicitly issued for the MCP server.",
"status": "verified",
"confidence": 0.88,
"access": "sample"
},
{
"id": "E13",
"sourceId": "S14",
"claimIds": [
"C2"
],
"summary": "CSA reported in March 2026 that 73% of surveyed organizations expected AI agents to become vital within a year, while 68% could not clearly distinguish human from AI-agent activity.",
"status": "verified",
"confidence": 0.88,
"access": "sample"
},
{
"id": "E14",
"sourceId": "S15",
"claimIds": [
"C2"
],
"summary": "Microsoft Entra Agent ID treats agent identities as a distinct identity type with classification, metadata, tailored controls, audit logs and agent sign-in logs.",
"status": "verified",
"confidence": 0.88,
"access": "sample"
},
{
"id": "E15",
"sourceId": "S16",
"claimIds": [
"C2",
"C3"
],
"summary": "Microsoft Foundry describes an agent identity as a special service principal and distinguishes attended delegated access from unattended app-only authority.",
"status": "verified",
"confidence": 0.88,
"access": "sample"
},
{
"id": "E24",
"sourceId": "S24",
"claimIds": [],
"summary": "OpenAI Agents SDK documentation notes that tool guardrails apply to function tools, while handoffs, hosted tools, built-in execution tools and agent-as-tool paths do not use the same guardrail pipeline.",
"status": "verified",
"confidence": 0.88,
"access": "sample"
},
{
"id": "E28",
"sourceId": "S29",
"claimIds": [],
"summary": "The 2025 AI Agent Index found that many deployed agents lack documented safety, evaluation, guardrail, sandboxing and third-party testing information, with documented incidents concentrated in browser agents and prompt injection.",
"status": "verified",
"confidence": 0.88,
"access": "sample"
}
],
"claims": [
{
"id": "C1",
"statement": "Agent security approval should be organized by route and action authority, not by agent brand.",
"confidence": 0.9,
"evidenceIds": [
"E1",
"E3",
"E14",
"E15"
],
"access": "sample"
},
{
"id": "C2",
"statement": "Production agents need governed non-human identities with owners, lifecycle state, permission records, disable paths and sign-in or activity logs.",
"confidence": 0.91,
"evidenceIds": [
"E13",
"E14"
],
"access": "sample"
},
{
"id": "C3",
"statement": "Delegated-user authority, app-only authority, service roles and agent-to-agent calls need separate approval because they create different audit and liability records.",
"confidence": 0.9,
"evidenceIds": [
"E3",
"E15"
],
"access": "sample"
},
{
"id": "C4",
"statement": "Tool tokens should be resource-bound, audience-checked, short-lived and scope-limited; token passthrough is a procurement red flag.",
"confidence": 0.92,
"evidenceIds": [
"E3",
"E4"
],
"access": "sample"
},
{
"id": "C5",
"statement": "Prompt injection becomes a permission problem when the agent can read hostile content and then call tools, browse, execute code or write records.",
"confidence": 0.9,
"evidenceIds": [
"E1"
],
"access": "sample"
}
],
"colophon": {
"checkedAt": "2026-06-13",
"latestRevisionAt": "2026-06-13T00:00:00Z",
"reviewStandard": "expert_human_reviewed",
"kinetics": {
"speed": "fast",
"impact": 0.93,
"momentum": 0.87,
"businessImpact": "AI agents are moving from answer generation into tool execution, delegated user action, service-account authority and cross-agent communication, which makes identity and permission design the production control.",
"rateOfChange": "Protocol, non-human identity and browser/tool execution guidance are changing approval evidence faster than annual access-review cycles.",
"from": "agent pilots with borrowed user accounts, shared API keys and prompt-only guardrails",
"toward": "credentialed agent routes with scoped delegation, tool approval, audit evidence, sandbox controls and reapproval triggers"
},
"watch": [
"5 August 2026: Black Hat USA 2026 Briefings open; agent-tool, prompt-injection, identity or cloud-runtime research could add negative tests to MCP, browser, sandbox and service-role approvals.",
"7 August 2026: Cloud Village at DEF CON 34 opens; cloud identity, metadata-service, VPC, egress or managed-service-agent research could tighten hosted-agent and AgentCore approval packets.",
"6 August 2026: Robotic Hacking Community at DEF CON 34 opens; physical-AI and robotics security work could move action-capable agents from software-only approval into fail-safe, operator and hardware-permission tests.",
"14 August 2026: Black Hat USA 2026 recorded briefings become available; white papers or replayed sessions may expose new exploit details that warrant route reapproval before September access reviews."
],
"gapAnalysis": "No public benchmark yet tests the same enterprise route across user-delegated OAuth, agent identity, service roles, MCP tools, A2A delegation, browser access, code execution, egress, human approval, rollback and SIEM export."
},
"body": {
"sections": [
{
"id": "executive-summary",
"title": "Executive summary",
"access": "sample",
"dek": "Credentialed routes set the approval boundary.",
"claimIds": [
"C1",
"C2",
"C3",
"C4",
"C5"
],
"evidenceIds": [
"E1",
"E3",
"E4",
"E13",
"E14",
"E15",
"E24",
"E28"
],
"blocks": [
{
"id": "executive-summary-narrative",
"evidenceIds": [
"E1",
"E3",
"E4",
"E13",
"E14",
"E15",
"E24",
"E28"
],
"type": "section_narrative",
"lead": "Agent security approval now starts with the credentialed action path: who the agent acts as, what token it uses, which tool it can call and how a failed action is revoked.",
"body": [
"A chat agent can be wrong. A tool-using agent can be wrong and spend money, send data, update a record, browse with a user's cookies, execute code or call another agent. The buying question has therefore moved from model safety to identity route approval, with governance, mapping, measurement and management attached to the action path [E47].",
"The route is the approved chain from human intent to accepted action: user identity, agent identity, token, tool, data boundary, reviewer, log record, rollback and reapproval trigger. That chain is now visible in public standards and provider documents, but no single vendor owns it end to end [E3, E14].",
"The immediate decision is simple: keep broad agents read-only until each action has a credentialed route. Delegated user actions must stay inside user permission. App-only or service-role authority needs its own owner, scope and revocation path. Browser, code and MCP tools need hostile-content tests before they see sensitive accounts or production systems [E4, E26]."
],
"detail": [
"Identity is the economic and legal unit of agent approval. A route with weak attribution cannot prove accepted work, allocate liability, price risk or survive an incident review.",
"Approval should be route-specific, not vendor-wide. A provider can be approved for one route and blocked for another."
]
},
{
"id": "executive-approval-tree",
"title": "Agent authority approval tree",
"evidenceIds": [
"E3",
"E4",
"E14",
"E15",
"E24"
],
"type": "decision_tree",
"lead": "Classify the authority before choosing the agent stack.",
"steps": [
{
"prompt": "Will the agent only read approved sources and return a draft answer?",
"tone": "success",
"branches": [
{
"label": "Yes",
"outcome": "Allow after source, identity and log checks.",
"tone": "success"
},
{
"label": "No",
"outcome": "Classify the action path.",
"next": "Q2",
"tone": "monitor"
}
]
},
{
"prompt": "Will it draft, stage, summarize or propose a record change?",
"tone": "warning",
"branches": [
{
"label": "Yes",
"outcome": "Require reviewer assignment, diff view, source record and no execution without acceptance.",
"tone": "warning"
},
{
"label": "No",
"outcome": "Check whether it can write or execute.",
"next": "Q3",
"tone": "monitor"
}
]
},
{
"prompt": "Can it write records, send messages, browse as a user, execute code, call tools or invoke another agent?",
"tone": "blocked",
"branches": [
{
"label": "Yes",
"outcome": "Require scoped identity, token-audience proof, tool schema, human approval and rollback evidence.",
"tone": "blocked"
},
{
"label": "No",
"outcome": "Keep as monitored read/draft route.",
"tone": "success"
}
]
},
{
"prompt": "Can the route touch secrets, payments, admin settings, regulated data or external commitments?",
"tone": "blocked",
"branches": [
{
"label": "Yes",
"outcome": "Block by default; approve only after security review, private eval, log export and incident drill.",
"tone": "blocked"
},
{
"label": "No",
"outcome": "Pilot with bounded scopes and reapproval triggers.",
"tone": "monitor"
}
]
}
]
},
{
"id": "executive-proof-bridge",
"evidenceIds": [
"E3",
"E4",
"E14"
],
"type": "section_narrative",
"lead": "Classified authority becomes proof gating.",
"body": [
"Once authority is classified, approval turns on proof: identity owner, token audience, tool schema, sandbox boundary, log export, reviewer gate and rollback path [E3, E14]. Browser, code and remote-tool routes need hostile-content and token-boundary proof before approval moves beyond a pilot [E4, E26]."
]
},
{
"id": "executive-route-table",
"title": "The first approval decision",
"evidenceIds": [
"E1",
"E3",
"E4",
"E13",
"E14",
"E15",
"E24",
"E28"
],
"type": "table",
"columns": [
{
"key": "route",
"label": "Route",
"align": "left"
},
{
"key": "default_decision",
"label": "Default decision",
"align": "left"
},
{
"key": "proof",
"label": "Proof that changes approval",
"align": "left"
}
],
"rows": [
{
"route": "Read-only agent over approved sources",
"default_decision": "Approve for pilot",
"proof": "Agent identity, source boundary, data-class rule, answer log, blocked write tools and no-answer behaviour."
},
{
"route": "User-delegated SaaS action",
"default_decision": "Approve narrowly",
"proof": "OAuth grant, user consent, user permission inheritance, token audience, approval record and revoke drill."
},
{
"route": "Agent identity with app-only authority",
"default_decision": "Security review",
"proof": "Owner, RBAC role, scope, service role, log export, access review and explicit break-glass rule."
},
{
"route": "MCP or A2A tool route",
"default_decision": "Conditional",
"proof": "Protected-resource metadata, tool schema, token validation, server trust, SSRF controls and tool-poisoning eval."
},
{
"route": "Browser, shell or code execution",
"default_decision": "Block until isolated",
"proof": "Sandbox boundary, egress policy, credential injection design, metadata-service block, snapshot and rollback evidence."
}
]
},
{
"id": "executive-companion-sandbox-link",
"evidenceIds": [],
"type": "report_link",
"reportId": "RPT_01KSK1V7Z9AISANDBOXROUTE01",
"slug": "ai-sandboxes-agent-execution",
"label": "AI sandboxes for agent execution",
"dek": "Use the sandbox report when the permission route includes code, browser, filesystem, repository, local tool or hosted execution boundaries.",
"relation": "Related report"
},
{
"id": "route-definition-callout",
"title": "Route definition",
"evidenceIds": [
"E1",
"E3",
"E4",
"E13",
"E14",
"E15",
"E24",
"E28"
],
"type": "callout",
"tone": "neutral",
"body": "Route means the approved path from work to accepted output: the source set, data boundary, model or vendor channel, tools, reviewer, evidence record and reapproval trigger that make an AI result usable."
}
]
},
{
"id": "identity-route-register",
"title": "Identity route register",
"access": "sample",
"dek": "Every approved action needs an identity record, a permission record and an evidence record.",
"claimIds": [
"C1",
"C2",
"C3"
],
"evidenceIds": [
"E13",
"E14",
"E15"
],
"blocks": [
{
"id": "identity-route-register-narrative",
"evidenceIds": [
"E13",
"E14",
"E15"
],
"type": "section_narrative",
"lead": "The route register is the minimum viable control plane.",
"body": [
"Most agent failures will not look like a model refusing a safety policy. They will look like ordinary access: a token reused for the wrong tool, a service role with broad storage rights, a user-delegated action that writes more than the user expected, or an agent acting through a shared account that nobody can disable cleanly.",
"The register turns those failures into answerable questions. Who owns the agent? Which identity authenticates? Is the action delegated from a human or app-only? Which resource is the token for? What fields can be read or written? Who approved the action? What log proves it happened? What revokes it?",
"Public signals are moving in the same direction. Entra Agent ID treats agents as a distinct identity type with sign-in and audit surfaces, and Foundry separates delegated and app-only flows [E14, E15]. Salesforce maps agents to profiles and permission sets, while Auth0 token vaulting keeps external provider tokens out of application code [E18, E21]."
],
"detail": [
"The weak route is the one that says the agent runs as a generic service account, user token, browser session or local process. That may be acceptable in a demo. It is a poor production identity unless every use is narrow, logged and revocable."
]
},
{
"id": "identity-route-register-table",
"title": "What the register should capture",
"evidenceIds": [
"E13",
"E14",
"E15"
],
"type": "table",
"columns": [
{
"key": "field",
"label": "Register field",
"align": "left"
},
{
"key": "accepted_answer",
"label": "Accepted answer",
"align": "left"
},
{
"key": "weak_answer",
"label": "Weak answer",
"align": "left"
}
],
"rows": [
{
"field": "Agent identity",
"accepted_answer": "Distinct identity, owner, sponsor, lifecycle status and disable path.",
"weak_answer": "Borrowed human account or shared API key."
},
{
"field": "Authority mode",
"accepted_answer": "Delegated user, agent principal, service role or agent-to-agent route named separately.",
"weak_answer": "The agent has access."
},
{
"field": "Resource scope",
"accepted_answer": "Audience, role, object, field, API, file path and environment boundaries named.",
"weak_answer": "Workspace or tenant access."
},
{
"field": "Tool schema",
"accepted_answer": "Typed action, parameter constraints, allowed data class and blocked parameter set.",
"weak_answer": "Natural-language tool instructions only."
},
{
"field": "Approval gate",
"accepted_answer": "Automatic, reviewer-approved, security-approved or blocked by action class.",
"weak_answer": "Prompt says be careful."
},
{
"field": "Evidence record",
"accepted_answer": "User, agent, token/resource, tool, input, output, reviewer, result and rollback fields exportable.",
"weak_answer": "Conversation transcript only."
}
]
},
{
"id": "identity-approval-bridge",
"evidenceIds": [
"E13",
"E14",
"E15"
],
"type": "section_narrative",
"lead": "Register fields become approval posture.",
"body": [
"The register names the identity, scope, tool and evidence fields. The authority matrix converts those fields into a default gate by action class, so read, draft, write, execute and admin routes do not receive the same approval."
]
},
{
"id": "identity-route-authority-matrix",
"title": "Identity route changes the approval gate",
"caption": "Read the cell as the default approval posture before private evals.",
"evidenceIds": [
"E14",
"E15"
],
"type": "visual_matrix",
"columns": [
"Read",
"Draft",
"Write",
"Execute",
"Admin"
],
"rows": [
{
"label": "User-delegated token",
"note": "Human permission remains visible.",
"cells": [
{
"label": "Allow",
"detail": "Log source and user.",
"tone": "success",
"strength": "high"
},
{
"label": "Allow",
"detail": "Review before acceptance.",
"tone": "success",
"strength": "medium"
},
{
"label": "Gate",
"detail": "Confirm user intent.",
"tone": "warning",
"strength": "gate"
},
{
"label": "Gate",
"detail": "Approval and revoke drill.",
"tone": "warning",
"strength": "gate"
},
{
"label": "Block",
"detail": "Do not delegate admin.",
"tone": "blocked",
"strength": "none"
}
]
},
{
"label": "Distinct agent identity",
"note": "Best production baseline.",
"cells": [
{
"label": "Allow",
"detail": "Narrow RBAC.",
"tone": "success",
"strength": "high"
},
{
"label": "Allow",
"detail": "Reviewer trail.",
"tone": "success",
"strength": "medium"
},
{
"label": "Gate",
"detail": "Action schema and logs.",
"tone": "warning",
"strength": "gate"
},
{
"label": "Gate",
"detail": "Sandbox and approval.",
"tone": "warning",
"strength": "gate"
},
{
"label": "Review",
"detail": "Security-owned exception.",
"tone": "blocked",
"strength": "low"
}
]
},
{
"label": "Service role",
"note": "Useful, dangerous when broad.",
"cells": [
{
"label": "Review",
"detail": "Scope to resource.",
"tone": "warning",
"strength": "medium"
},
{
"label": "Review",
"detail": "No implicit write.",
"tone": "warning",
"strength": "medium"
},
{
"label": "Gate",
"detail": "SourceArn or equivalent.",
"tone": "blocked",
"strength": "gate"
},
{
"label": "Gate",
"detail": "Metadata and egress controls.",
"tone": "blocked",
"strength": "gate"
},
{
"label": "Block",
"detail": "Avoid broad admin role.",
"tone": "blocked",
"strength": "none"
}
]
},
{
"label": "Shared credential",
"note": "Demo-only unless exceptional.",
"cells": [
{
"label": "Avoid",
"detail": "Attribution weak.",
"tone": "warning",
"strength": "low"
},
{
"label": "Avoid",
"detail": "Cannot split intent.",
"tone": "warning",
"strength": "low"
},
{
"label": "Block",
"detail": "No accountable actor.",
"tone": "blocked",
"strength": "none"
},
{
"label": "Block",
"detail": "Credential exposure risk.",
"tone": "blocked",
"strength": "none"
},
{
"label": "Block",
"detail": "Unusable audit trail.",
"tone": "blocked",
"strength": "none"
}
]
}
],
"legend": [
{
"label": "Allow",
"tone": "success",
"strength": "high"
},
{
"label": "Gate",
"tone": "warning",
"strength": "gate"
},
{
"label": "Block",
"tone": "blocked",
"strength": "none"
}
]
},
{
"id": "identity-route-register-section-callout",
"title": "Approval test",
"evidenceIds": [
"E14",
"E15"
],
"type": "callout",
"tone": "info",
"body": "Ask for the route register before the SOC 2 report: agent identity, delegated user, tool, scope, data class, approval gate, log export and revoke path for each action."
}
]
},
{
"id": "delegation-and-token-boundary",
"title": "Delegation and token boundary",
"access": "locked",
"dek": "The token is where agent authority becomes real.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "delegation-and-token-boundary-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "protocol-and-tool-boundaries",
"title": "Protocol and tool boundaries",
"access": "locked",
"dek": "MCP and A2A are useful because they make the boundary explicit. They are risky when buyers treat that boundary as solved.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "protocol-and-tool-boundaries-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "platform-control-surfaces",
"title": "Platform control surfaces",
"access": "locked",
"dek": "Provider controls are useful evidence. They are not interchangeable.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "platform-control-surfaces-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "control-plane-directory",
"title": "Control-plane directory",
"access": "locked",
"dek": "The buyer should separate identity, protocol, runtime and tool-control claims before comparing vendors.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "control-plane-directory-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "incident-and-exploit-patterns",
"title": "Incident and exploit patterns",
"access": "locked",
"dek": "Public exploit evidence turns prompt injection from model risk into route evidence.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "incident-and-exploit-patterns-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "prompt-injection-evals",
"title": "Prompt-injection and tool evals",
"access": "locked",
"dek": "The eval should attack the permission route, not the model in isolation.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "prompt-injection-evals-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "sandbox-egress-and-recovery",
"title": "Sandbox, egress and recovery",
"access": "locked",
"dek": "The execution boundary decides how far a bad instruction can travel.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "sandbox-egress-and-recovery-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "operating-model",
"title": "Operating model",
"access": "locked",
"dek": "Agent security needs owners who can change permissions, not only reviewers who can score outputs.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "operating-model-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "workflow-route-playbooks",
"title": "Workflow route playbooks",
"access": "locked",
"dek": "Approval should be written route by route, not as one enterprise agent policy.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "workflow-route-playbooks-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "approval-economics",
"title": "Approval economics",
"access": "locked",
"dek": "The cheapest unsafe route is expensive after the first bad action.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "approval-economics-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "contract-and-procurement",
"title": "Contract and procurement proof",
"access": "locked",
"dek": "Security pages are starting points. The contract has to carry the route.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "contract-and-procurement-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "reapproval-triggers",
"title": "Reapproval triggers",
"access": "locked",
"dek": "Agent routes go stale when identity, protocol, tool or sandbox assumptions change.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "reapproval-triggers-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "known-unknowns",
"title": "Known unknowns",
"access": "locked",
"dek": "Public evidence supports safer route approval; agent IAM is not solved.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "known-unknowns-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "recommended-next-steps",
"title": "Recommended next steps",
"access": "locked",
"dek": "Move from agent inventory to route approval.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "recommended-next-steps-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "source-ledger",
"title": "Source ledger",
"access": "locked",
"dek": "Primary sources and diligence anchors behind the analysis.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "source-ledger-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "glossary",
"title": "Glossary",
"access": "sample",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "glossary-table",
"title": "Terms used in this report",
"caption": "Definitions are reader aids, not separate evidence claims.",
"evidenceIds": [],
"type": "table",
"columns": [
{
"key": "term",
"label": "Term",
"align": "left"
},
{
"key": "meaning",
"label": "Plain meaning",
"align": "left"
}
],
"rows": [
{
"term": "Route",
"meaning": "The approved path from work to accepted output: source set, data boundary, model or vendor channel, tools, reviewer, evidence record and reapproval trigger."
},
{
"term": "API",
"meaning": "Application programming interface: a governed software connection used by an app or workflow to call a model or service."
},
{
"term": "SDK",
"meaning": "Software development kit: packaged code and tools developers use to connect a product to an API or service."
},
{
"term": "LLM",
"meaning": "Large language model: a model trained to read and generate text-like tokens."
},
{
"term": "Token",
"meaning": "A chunk of text used for billing, context windows and rate limits. It is usually smaller than a word, not a page count."
},
{
"term": "RAG",
"meaning": "Retrieval-augmented generation: search approved sources first, then pass selected evidence into the model."
}
]
}
]
}
]
}
},
"gap_analysis": "No public benchmark yet tests the same enterprise route across user-delegated OAuth, agent identity, service roles, MCP tools, A2A delegation, browser access, code execution, egress, human approval, rollback and SIEM export.",
"kinetics": {
"speed": "fast",
"impact": 0.93,
"momentum": 0.87,
"businessImpact": "AI agents are moving from answer generation into tool execution, delegated user action, service-account authority and cross-agent communication, which makes identity and permission design the production control.",
"rateOfChange": "Protocol, non-human identity and browser/tool execution guidance are changing approval evidence faster than annual access-review cycles.",
"from": "agent pilots with borrowed user accounts, shared API keys and prompt-only guardrails",
"toward": "credentialed agent routes with scoped delegation, tool approval, audit evidence, sandbox controls and reapproval triggers"
},
"watch_signals": [
"5 August 2026: Black Hat USA 2026 Briefings open; agent-tool, prompt-injection, identity or cloud-runtime research could add negative tests to MCP, browser, sandbox and service-role approvals.",
"7 August 2026: Cloud Village at DEF CON 34 opens; cloud identity, metadata-service, VPC, egress or managed-service-agent research could tighten hosted-agent and AgentCore approval packets.",
"6 August 2026: Robotic Hacking Community at DEF CON 34 opens; physical-AI and robotics security work could move action-capable agents from software-only approval into fail-safe, operator and hardware-permission tests.",
"14 August 2026: Black Hat USA 2026 recorded briefings become available; white papers or replayed sessions may expose new exploit details that warrant route reapproval before September access reviews."
],
"sample_findings": [
"Approve the credentialed route before the agent gets authority."
]
}
```