Notifications
Clear all
Topic starter
22/07/2026 4:38 pm
TL;DR: A new survey on isolation in LLM-agent systems argues that the recurring failures behind prompt injection, tool misuse, memory poisoning, and unsafe execution all trace back to broken boundaries, and that enforcement must sit outside the model, according to Pomerium's analysis of the research. The core issue is that probabilistic guardrails cannot substitute for structural control when agents can turn text into action.
NHIMG editorial — based on content published by Pomerium: Agents Have Boundary Issues. Your Infrastructure Shouldn't
By the numbers:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams set access boundaries for AI agents?
A: Security teams should define agent boundaries around data sources, tools, and allowed actions before any production rollout.
Q: Why do autonomous AI systems change the way IAM teams think about least privilege?
A: Least privilege becomes harder to define when intent is not fixed at provisioning time.
Q: What breaks when agent execution is allowed to inherit model trust?
A: The separation between reasoning and authority collapses.
Practitioner guidance
- Move boundary enforcement outside the model Place policy evaluation, credential issuance, and egress control in infrastructure that the agent cannot rewrite or persuade.
- Scope agent tool access by capability Restrict each agent to a minimal set of named tools and accepted argument patterns.
- Separate execution credentials from reasoning Issue short-lived, request-scoped tokens for agent actions and ensure the reasoning component never holds durable secrets.
What's in the full article
Pomerium's full blog post covers the operational detail this post intentionally leaves for the source:
- The exact route-policy pattern used to constrain MCP tool access in front of internal applications.
- How short-lived identity issuance changes the execution boundary for agents that can click, submit, or call APIs.
- The logging and audit context attached to allow-or-deny decisions at the proxy layer.
- The separation between user-agent, system-environment, and agent-execution controls in the five-boundary model.
👉 Read Pomerium's analysis of agent boundary enforcement and MCP access control →
AI agent boundary enforcement: are your controls keeping up?
Explore further
22/07/2026 4:42 pm
Hard boundaries, not prompt discipline, are the only durable control model for agents. The article correctly identifies that refusal behavior, model training, and system prompts remain probabilistic under pressure. That means the security boundary must live in identity-aware infrastructure, where policy is deterministic and independent of model persuasion. The practitioner conclusion is that agents should be governed like any other privileged runtime, only with tighter execution controls.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to The 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to The 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who is accountable when an AI agent takes an unsafe action?
A: Accountability should sit with the business owner of the agent, the team that provisioned the access, and the control owners responsible for monitoring and revocation. If no one can answer who approved the identity, the scope, and the oversight model, the governance framework is not complete enough for production.
👉 Read our full editorial: AI agent boundary enforcement belongs outside the model
