Topic starter
14/09/2026 10:10 am
TL;DR: AI agent security splits into two different controls, according to Trust3: content guardrails can block unsafe prompts and outputs in under 80ms, but they do not decide whether an agent should reach a tool or dataset at all. The harder gap is delegated identity and scope, because A2A chains can carry a request several hops beyond the original agent without a clear access decision.
Editorial analysis by NHI Mgmt Group, based on content published by Trust3: “Is Fiddler Enough for A2A Security? What Agent Observability Doesn’t Cover”.
Key questions
Q: What breaks when security teams rely on content guardrails to control AI agents?
A: Content guardrails only inspect what an agent says, not what it does.
Q: Why do delegated AI agent chains increase access risk?
A: Because each hop can lose the original task boundary.
Q: How do security teams know whether an AI agent control stack is actually working?
A: Look for three things: every agent has a traceable identity, permissions are narrow enough to explain in operational terms, and actions can be audited end to end.
Practitioner guidance
- Separate content policy from access policy Document which decisions are about text safety and which are about data or tool authorisation.
- Bind agent access to declared purpose Require each agent request to carry a declared purpose and a short-lived scope, and reject requests that reuse standing access for tasks outside that purpose.
- Treat every hop as a new authorisation event For A2A flows, decide whether each handoff may inherit context, reach new tools, or touch new datasets before the next agent executes.
Bottom line: AI agent security is split between content filtering and access authorisation, and treating them as the same control leaves a governance gap.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:11 am
Content safety and access authorisation are different controls, and confusing them creates a false sense of coverage. A prompt can be safe while the agent behind it is not entitled to the data or tool it is about to use. That is a governance distinction, not a tuning issue, and programmes that collapse it into one layer will overestimate their control coverage. The practitioner conclusion is that content checks and access checks must be designed as separate enforcement points.
A question worth separating out:
Q: What should organisations do when an AI agent delegates work to other agents?
A: Organisations should require a traceable delegation chain that records the initiating identity, each handoff, each tool call, and the business purpose of downstream access. Without that chain, teams cannot determine whether the final action still matched the original authorization or whether privilege expanded silently as the workflow progressed.
👉 Read our full editorial: AI agent security needs both content checks and access controls