Topic starter
21/08/2026 4:49 pm
TL;DR: The Rule of Two breaks down in real deployments because two-out-of-three conditions can still produce destructive outcomes, from prompt injection in developer tools to autonomous agents deleting production data, according to Noma Security's analysis. The implication is direct: agentic risk is driven less by static features than by how much capability, autonomy, and privilege the system can combine at runtime.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “Why the Rule of Two Can't Protect Your Agents: MCP Servers, Agentic Risk, and the Framework That Should Replace It”.
Key questions
Q: What breaks when the rule of two is used to govern AI agents?
A: The rule breaks when it assumes that missing one risky property meaningfully contains agent behaviour.
Q: Why does autonomy matter more than a static agent risk checklist?
A: Autonomy matters because an agent that can act without human approval can chain decisions faster than a static checklist can capture.
Q: What are the signs that agent governance is too shallow?
A: Common signs include prompts being accepted without inspection, tool calls executing without pre-checks, and outputs being trusted before disclosure review.
Practitioner guidance
- Map agents against capability, autonomy, and permissions Score each deployed agent on what it can do, how independently it can act, and which identity it runs under.
- Add approval gates to sensitive agent actions Require human confirmation before state-changing operations such as file deletion, resource teardown, or database writes.
- Govern the invisible reasoning layer Review Skills, retrieved context, and other instruction sources that can shape behaviour before any tool call is logged.
Bottom line: The Rule of Two is too simplistic for agentic AI because destructive outcomes can occur with only part of the expected risk combination.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:07 pm
Rule-of-two logic is too coarse for agentic security: The framework counts properties, but real-world agent behaviour is about how those properties combine at runtime. An agent can remain dangerous with only untrusted input and state change, or with permissions alone, because the blast radius depends on execution context, not just feature count. Practitioners should treat this as proof that combinatorial frameworks must give way to control models that reflect runtime authority.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern agent skills and retrieved context?
A: Teams should govern them as part of the agent attack surface because they can steer behaviour before any obvious tool call occurs. If instruction layers can change outcomes without generating clear logs, they need the same scrutiny as explicit permissions and connectors.
👉 Read our full editorial: Rule of two fails for AI agents: why No Excessive CAP matters