Most of my experience is in Financial Services and I have worked with different institutions, different regulators, very different levels of maturity, but one thing remains the same everywhere: nobody who approves a payment is allowed to be the person who initiated it.
That's maker-checker. Four-eyes, if you learned it on the European side. You find it holding up most of the business once you start looking. A payment release needs a second authorizer, and above a threshold it needs dual authorization before the wire moves. A portfolio manager can decide to buy, but a pre-trade compliance check sitting outside their discretion decides whether the order is allowed, and it can stop them. A bulk rebalance across a book of wealth accounts gets proposed, then checked against every mandate and restriction before any orders are cut.
In all three the thing that approves is separate from the thing that decides, and it's deterministic. Same input, same answer, every time. That is what makes it auditable.
An AI agent does both jobs at once. It decides what to do, and it is the only thing deciding whether it is allowed to. We wouldn't accept that from a person anywhere else in the business. We've accepted it from software because it arrived looking like a feature.
What the industry is saying
Read anything published to security leaders this year and four things come up.
- Find your agents. Gartner's first cybersecurity trend for 2026 is agentic AI oversight, and its opening instruction is to identify both sanctioned and unsanctioned agents.
- Treat them as identities. Gartner has a separate trend on identity and access management adapting to machine actors.
- The numbers. Collected in the Cloud Security Alliance's note on the agent governance gap: 92% of organizations lack full visibility into their agent identities, 86% don't enforce access policies for them, and 95% doubt they could detect or contain a compromised agent.
- The frameworks don't cover this. NIST AI RMF, ISO/IEC 42001 and the EU AI Act were all written before tool-calling agents, and the EU AI Act has no definition of an agentic system at all.
All of that is right. I'd sign all of it.
It is also all about seeing.
Discovery, inventory, visibility, extending the SIEM, extending the UEBA. Every one of those describes something that already happened. The CSA note says so itself, almost in passing: SIEM, DLP and UEBA may capture the final API call but miss the chain of agent decisions behind it.
Think about what that chain looks like. An agent retrieves a document, reads an instruction sitting inside it, decides to call a tool, passes an argument to that tool, gets a response back and treats it as fact. By the time any of that reaches a log, every decision that mattered has been made. The log is a receipt.
Which is why the 95% is the number I keep going back to. It isn't "we can't see our agents." It's that we don't think we could stop one. That is not a visibility problem. It is a question about who holds the authority to say no, at the moment the action is proposed.
Six surfaces, three of them never measured
An agent can be reached in six places: the ingress prompt and any attached files, retrieval, tool and MCP calls, session memory, agent-to-agent calls, and the model's response on the way out. We went through each of them in The agentic attack surface.
What's worth adding is how little of that anyone has counted. One survey puts end-to-end monitoring across prompts, tool calls and outputs at 38%, and continuous agent-to-agent monitoring at 17%. For attached files, retrieval and session memory I couldn't find a published figure anywhere.
They don't behave alike either, which is the part that makes a single control useless. A poisoned retrieval is a one-shot problem. A poisoned memory entry survives the session, so it behaves more like a backdoor. An agent-to-agent call passes authority down a chain with nothing recording who approved what.
What this changes, and what it doesn't
Same controls, only harder.
- Least privilege
- Data boundaries
- Third-party risk
- An audit trail an examiner will accept
Check often, assume less.
- Quarterly access reviews miss agents that live for ninety seconds.
- DLP scans files. Agents leak data through ordinary tool calls.
- Pen tests check code. Agents decide at runtime.
Small, but unprecedented.
- Prompts now act as instructions.
- Agents hand work to agents, with no record of who approved it.
- A bad memory entry outlives its session.
CSA makes the same point about periodic scanning giving way to continuous approaches, which is the argument in Real-time compliance vs the annual audit.
A panel of security leaders recently published three questions I liked more than most frameworks, because you can ask them on Monday:
- How many agents do we run, and who owns each one?
- What can each agent reach, and who approved that?
- If one goes wrong at 3am, how fast can we stop it and what evidence do we keep?
The third is the one that exposes everything, because answering it needs an enforcement point, a kill path and a record that survives scrutiny, of the kind we described in Cryptographically verifiable audit trails. Most teams find they have none of the three.
On timing, CSA expects sector regulators to start interpreting existing rules for agents inside twelve to eighteen months. I don't know which one moves first.
What we're building
Trustgate AI is a self-hosted security gateway for agentic AI. It runs inside the customer's network, and no prompt, record or document leaves the perimeter, which is the only shape most regulated institutions can sign.
SHASHU, our detection engine, runs a different scanner on each of the six surfaces instead of one model on the prompt. Cedar, the policy layer, is deterministic and default-deny, written per tool. The agent proposes. Something that isn't the agent decides.
Because a checker can't be a probability.
