Topic starter
09/07/2026 12:02 pm
TL;DR: AI agents can leak secrets, display PII, and execute destructive commands unless guardrails are enforced at the tool layer, not just in prompts or transcript scanning, according to Knostic. The deeper lesson is that agent security depends on runtime enforcement, because policy text alone cannot reliably stop harmful execution paths.
Editorial analysis by NHI Mgmt Group, based on content published by Knostic: “Building openclaw-shield: Lessons Learned Securing OpenClaw Agents”.
Key questions
Q: What fails when AI agent guardrails exist only in prompts and logs?
A: The control fails because prompts and logs are not enforcement points.
Q: Why do AI agents need runtime enforcement instead of relying only on upstream identity controls?
A: AI agents can decide and act dynamically inside the execution loop, so upstream authentication alone does not control every tool call or data request.
Q: How do security teams know whether an AI agent control stack is actually working?
A: Look for three things: every agent has a traceable identity, permissions are narrow enough to explain in operational terms, and actions can be audited end to end.
Practitioner guidance
- Enforce execution-path denial for risky agent actions Require every file read, shell command, or privileged tool call to pass through an allow-or-deny gate before execution proceeds.
- Classify prompt policy as advisory only Use context injections to guide behaviour, but do not treat prompt text as a sufficient barrier for destructive commands or secret access.
- Redact secrets before transcript persistence Scan tool results for API keys, tokens, certificates, and PII before they are stored in conversation history, while assuming the model may already have seen the raw value.
Bottom line: AI agents can still expose secrets, disclose PII, or run destructive commands when guardrails live only in prompts or post-processing.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 12:03 pm
Runtime enforcement is the real control boundary for AI agents: This article shows that prompt text, logging, and post-processing do not constitute a reliable security boundary once an agent can read files and execute commands. The decisive question is whether the system can deny a risky action before the model or tool completes it. For practitioners, the control conversation starts at execution time, not at policy drafting.
A few things that frame the scale:
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
A question worth separating out:
Q: What should teams do when AI agents are allowed to run shell commands?
A: They should scope tool permissions tightly and require a real approval or denial decision before any command is executed. The key governance point is that the agent must not be able to self-authorise destructive actions simply because it was prompted to act on a user’s behalf.
👉 Read our full editorial: openclaw-shield shows where AI agent guardrails fail