Notifications
Clear all
Topic starter
21/08/2026 4:49 pm
TL;DR: The Rule of Two breaks down in real deployments because two-out-of-three conditions can still produce destructive outcomes, from prompt injection in developer tools to autonomous agents deleting production data, according to Noma Security's analysis. The implication is direct: agentic risk is driven less by static features than by how much capability, autonomy, and privilege the system can combine at runtime.
NHIMG editorial — based on content published by Noma Security: Why the Rule of Two Can't Protect Your Agents: MCP Servers, Agentic Risk, and the Framework That Should Replace It
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: What breaks when an agent has broad tools but weak oversight?
A: Broad tools plus weak oversight create a compounding risk path where a single bad input can become a destructive action.
Q: How do organisations know if agent governance is actually working?
A: Agent governance is working when every agent is discoverable, owned, least privileged, and auditable at the action level.
Practitioner guidance
- Assess agent risk across three dials Score every agent deployment for excessive capabilities, excessive autonomy, and excessive permissions before production rollout.
- Separate observable tools from hidden instructions Review whether your monitoring only captures structured tool calls and ignores reasoning instructions, prompt layers, or skill definitions that can redirect actions without a visible event.
- Reduce blast radius with scoped identities Bind agents to delegated identities with the narrowest possible permissions and avoid static credentials that outlive the task or user context they were intended to represent.
What's in the full article
Noma Security's full blog post covers the operational detail this post intentionally leaves for the source:
- The full explanation of the Rule of Two critique and the logic behind Excessive CAP.
- Original research examples tied to ForcedLeak and GeminiJack that show how indirect prompt injection breaks current assumptions.
- The RSAC 2026 session framing and how the authors position the new model for practitioner adoption.
- A deeper walkthrough of how capabilities, autonomy, and permissions compound in live agent deployments.
👉 Read Noma Security's analysis of the Rule of Two and No Excessive CAP for agents →
AI agent risk frameworks: is the rule of two already broken?
Explore further
21/08/2026 5:07 pm
Rule-of-two governance is already obsolete for agentic systems. The framework assumes agent risk can be bounded by limiting three properties, but runtime behaviour breaks that assumption as soon as agents can combine tools, context, and permissions dynamically. Once the execution path is decided at runtime, the static yes or no logic of the Rule of Two no longer describes the identity problem accurately. Practitioners should treat this as a signal that agent governance needs a continuously evaluated model, not a one-time design rule.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable when an AI agent causes a security incident?
A: Accountability should sit with the business owner, the system owner, and the security function together, because agent behaviour crosses operational boundaries. Organisations need a defined owner for approval, monitoring, and retirement, plus audit evidence that shows what the agent accessed and why.
👉 Read our full editorial: Rule of two fails for AI agents: why No Excessive CAP matters
