FREQUENTLY ASKED QUESTIONS
What proof is there that Mountain Theory actually stops an autonomous AI action?
Two published runs, both with terminal recordings and both naming the third-party technology involved. In the first, the same 10 actions were run in the same order under three configurations. Ungoverned, 10 of 10 executed. Under NVIDIA OpenShell alone, all 5 sandbox-boundary crossings were denied at the kernel and all 3 in-bounds bad decisions still went through, including a secrets read that printed credentials to the screen. Under OpenShell plus Mountain Theory, those same 3 actions returned HOLD, HOLD and BLOCK, and the secrets read was stopped before it executed, so the credentials never printed. In the second, a third-party provider updated the foundation model driving an autonomous agent. Nothing on our side changed, the agent began attempting multi-step actions it had never tried before, and every attempt was stopped on 30 and 31 July 2026, the days the behaviour first appeared. No new rule, no signature, no patch.
Does a FedRAMP authorization or SOC 2 mean a vendor can control autonomous AI?
No. A compliance authorization attests to how a vendor runs its own service: that controls exist, that processes are documented, that evidence is retained. That is real and it matters in procurement. It is not a measurement of whether a product can stop an autonomous agent from taking a specific action, because no compliance regime was designed to test that. A vendor can hold every certification available and still have nothing in the path when an agent decides to delete evidence, disable a control, or read secrets it is technically permitted to read. The only thing that shows an action was stopped is a run where that action was attempted and did not execute.
How should I evaluate competing AI security vendors on evidence?
Ask every vendor for the same four things and compare the answers side by side. First, the action set: exactly which actions were attempted, in what order. Second, the control condition: what happened with nothing in the path, so there is a baseline to measure against. Third, the outcome per action, including the ones the product did not stop. Fourth, the recording or log. A vendor who publishes all four is making a checkable claim. A vendor who publishes a certification, an integration list or a customer logo is telling you about their process and their distribution, which are different questions. Mountain Theory publishes all four, including the actions it does not have a policy for.
What is AI infrastructure defense?
AI infrastructure defense is security for the moment an AI system acts, not the moment it thinks. It sits between the AI's decision and the action that decision would trigger. Every proposed action is checked against your policy before it reaches the system it would touch. Mountain Theory builds AI infrastructure defense for enterprises.
How do you stop an AI agent from taking a harmful action?
You stop it at the execution layer, by checking the action before it runs. Filtering the prompt does not help once the model has already decided. Mountain Theory evaluates each action against policy and returns one of three outcomes: ALLOW, HOLD or BLOCK. The action does not execute until it has been checked.
What happens when an AI agent is authorized but wrong?
Authorization is the problem, not the protection. A compromised or manipulated agent uses the exact permissions you granted it, so identity and access controls see nothing unusual. The gap is between what the agent is allowed to do and what it should do right now. Mountain Theory closes that gap by checking each action at the point of execution.
What is the execution layer in AI security?
The execution layer is where an AI system's decision becomes a real action. It is the step after the model produces output and before an API call, a database write, a payment or a message actually happens. Most AI security operates before this point, on prompts and outputs. Control at the execution layer is what determines whether an action occurs.
How is this different from prompt filtering?
Prompt filtering inspects language. Execution control inspects actions. A filter can miss a manipulation, and once the model is convinced, the filter has nothing left to catch. An execution check does not care how the agent was persuaded, because it evaluates the action itself against policy. The two operate at different layers and are not substitutes.
Does this require a human to approve every action?
No. Mountain Theory runs autonomously by default. HOLD is an option you switch on for the actions you choose, not a requirement. You decide where a person steps in, and everything else is checked and allowed to proceed without waiting on anyone.
How do you write policy without writing code?
Policy is written in plain English. You describe what the AI is allowed to do, and in what circumstances, in the same language you would use to brief a person. That policy is what each action is checked against.
Is AI agent activity auditable?
Yes. Every decision is recorded with who or what proposed the action, what was proposed, when, what the outcome was, and why. The record is append-only, so it can be used as evidence. This is built for SOC 2, ISO 27001, PCI DSS, GDPR, HIPAA, FERPA, CMMC and CCPA programmes.
Which AI models does this work with?
Mountain Theory is model agnostic. It sits at the execution layer, so it does not depend on which model produced the decision, or on that model's provider, version or hosting.
Who is Mountain Theory for?
Mountain Theory is enterprise-first. The strongest fit is organisations where an AI acting wrongly has physical or regulatory consequences: public safety and NG911, defense, financial services, healthcare, education under FERPA, and disaster response.
How do you secure an AI workflow?
You secure an AI workflow by controlling what it is allowed to do at the point of execution, not by reviewing it afterwards. Each step a workflow tries to take is checked against policy before it runs, so a workflow that is manipulated mid-run still cannot act outside what you allowed. Logging alone does not secure a workflow, because it tells you what happened after it already happened.
What is a prompt injection attack, and how do you defend against it?
A prompt injection attack hides instructions in content an AI reads, so the AI follows the attacker instead of you. The content can be a web page, a document, an email or a calendar invite. Defending it by inspecting language alone is unreliable, because the attack succeeds by looking legitimate. The durable defense is at the execution layer: even if the AI is convinced, the action it then attempts is still checked against policy before it runs.
What is agentic AI security?
Agentic AI security is protecting systems where an AI takes actions on its own rather than only producing text. The risk changes because the AI now has permissions, tools and reach into other systems. The control that matters is over the actions it takes, since the same permission that makes an agent useful is what makes a compromised agent dangerous.
Can an AI agent be trusted with production systems?
An AI agent can be trusted with production systems when its actions are constrained by something outside the agent itself. Trust based on the model behaving well is not a control, because the model can be manipulated and its behaviour changes between versions. Mountain Theory places the constraint outside the agent, so the boundary holds regardless of what the agent was persuaded to attempt.
Does Mountain Theory replace my existing security tools?
No. Mountain Theory covers a layer your existing tools do not reach. Identity and access management decides what an AI is permitted to do. Monitoring records what it did. Neither one stops a permitted action that should not happen right now. Mountain Theory sits at that gap and leaves the rest of your stack in place.
How do you prove to an auditor that an AI system is under control?
You prove it with a record of every action the AI proposed, the policy it was checked against, the outcome, and the reason. Mountain Theory produces that record as an append-only log, so it stands up as evidence rather than as a report someone assembled afterwards. That is what an auditor asks for under SOC 2, ISO 27001, HIPAA, FERPA and CMMC.
What is inline AI runtime security?
Inline AI runtime security means the control sits in the path the AI actually runs through, rather than watching from the side. If a check is not inline, it can only report what already happened. The distinction that matters is where inline sits: some products are inline on the prompt and the response, and some are inline on the action. Mountain Theory is inline on the action, between the decision and the thing that decision would do.
What is an AI firewall?
An AI firewall inspects traffic to and from a model and blocks content that breaks a rule. It is a content control: it looks at what goes in and what comes out. It does not evaluate the action a model then takes, because by that point the traffic has already passed inspection. An authenticated agent issuing a destructive command is not a content problem, so a firewall is the wrong layer to stop it.
Do I need AI guardrails or execution control?
Guardrails and execution control solve different problems and most enterprises need both. Guardrails stop a model from saying something unsafe. Execution control stops an agent from doing something unsafe. A jailbreak filter does not stop an authenticated agent from deleting a database, because nothing unsafe was said. If your AI only produces text, guardrails may be enough. If it takes actions, they are not.
What is non-human identity (NHI) security?
Non-human identity security governs the credentials that machines use: API keys, service accounts, OAuth tokens and now AI agents. It answers who an agent is and what it is permitted to do. It is necessary and it is upstream of the problem here. Identity solves attribution, and it authorises the agent once at the start of a session. It cannot help when a correctly identified agent, with valid credentials, does the wrong thing.
What is AI security posture management (AI-SPM)?
AI security posture management discovers your AI assets, maps their risk, and reports what is misconfigured or exposed. It gives you the inventory and the risk picture. It is a visibility layer, so it tells you what your exposure looks like rather than intervening in the moment. Posture answers what could go wrong. Execution control answers what happens when it does.
What is MCP security?
MCP security protects deployments of the Model Context Protocol, the standard that lets AI models call external tools and data sources. The risk is that MCP hands an agent real reach into real systems. Securing the protocol matters, and so does governing the action once a tool call is made. Mountain Theory checks the action itself against policy, regardless of whether it arrived over MCP, an API, or a framework calling a function directly.
Is AI red teaming enough to secure an AI system?
No. AI red teaming finds weaknesses before deployment and it is worth doing. It is testing, so it tells you what an attacker could achieve at a point in time, against the model as it was that day. It does not stop anything in production. Models change, attackers adapt, and a finding does not become a control until something enforces it at runtime.
What is an AI gateway?
An AI gateway brokers traffic between users and models, usually to apply data loss prevention, masking, or access rules at the boundary. It works at the perimeter, between the person and the model. That is a useful place to protect data. It is not where an autonomous agent acts, because an agent operating inside your systems is already past the perimeter when it decides to do something.
What is agent goal drift?
Agent goal drift is when a multi-step AI agent gradually moves away from the task it was given, often because something in its context pushed it. Detecting drift means reasoning about intent, which takes time and is probabilistic. Checking the action is deterministic: the action either matches policy or it does not. Both approaches have a place, but only one gives a definite answer before the action runs.
What is deterministic policy enforcement for AI?
Deterministic policy enforcement means the same action against the same policy always produces the same decision, with no model inference in the decision path. It matters because a probabilistic control cannot be audited: you cannot show a regulator a control that might behave differently next time. Mountain Theory is deterministic at the point of enforcement, and the policy behind it is written in plain English rather than code.
What is the difference between AI governance and AI security?
AI governance is the policy, documentation and oversight that says what your organisation permits. AI security is what actually enforces it. Governance produces the rule and the evidence trail. Without enforcement it is a document, because nothing stops the action when the moment comes. Mountain Theory is the enforcement half, and it produces the evidence governance needs as a by-product.
What is an AI circuit breaker?
An AI circuit breaker sits between an AI system's decision and the action it would trigger, and stops the action when it breaks policy. The name comes from electrical engineering: the breaker does not judge the appliance, it opens the circuit when current crosses a threshold. Applied to AI, it means the action does not execute until it has been checked. That is the architecture Mountain Theory is built on.