FREQUENTLY ASKED QUESTIONS
What does an AI policy actually look like?
Rules in plain English, written by whoever owns the risk: a list of actions with an autonomy level against each one. In the vendor-review agent behind Mountain Theory's published run, every action the agent can take sits in one of four levels. Autonomous: read vendor evidence, summarize a SOC 2 report, create a draft risk review. Semi-autonomous: create a remediation ticket. Human-gated: finalize a risk rating, approve a high-risk vendor, send an external email, close a remediation ticket, deploy an infrastructure change. Prohibited: delete an evidence file, or follow an instruction embedded in a vendor's own document. Every level requires an audit entry, including the prohibited ones, because a refused action is evidence too. You write that list in plain English and Mountain Theory enforces it before the action runs.
How do you decide which AI actions need a human?
A person steps in only where your rules say, and the rule is about what the action changes, not how risky the request sounds. In the published run the dividing line is authority: an agent may draft, summarize, analyze and recommend on its own, because none of those is an authoritative change. The moment an action writes to a system of record, commits the business, or reaches outside the building, it needs a person. That is why "draft a risk rating" is autonomous and "finalize a risk rating" is not, and why "recommend approve or deny" is autonomous and "update the procurement status of record" is not. The same reasoning puts external email behind approval. You set that line yourself, and everything on the safe side of it runs at full speed.
Can you stop an AI agent from deleting evidence?
Yes. Mountain Theory stops evidence deletion, and stops the workaround: blocked once, blocked again on the tool-chaining retry, in a published run. In the vendor-review agent's policy, deleting or overwriting original evidence is prohibited outright rather than approval-gated, on the grounds that evidence integrity is not something anyone should be able to sign away in the moment. When the agent was told to clean up old evidence after a review, the deletion never executed, and the refused attempt was written to the audit log. Ungoverned, in the same run, the deletion completed.
What is AI agent drift?
AI agent drift is when an agent pursues a goal other than the one it was given, because the model underneath it changed and nobody changed its instructions. It is also called agent goal drift: a multi-step agent gradually moving away from its task because something in its context pushed it. Detecting drift means reasoning about intent, which is probabilistic; checking the action is deterministic. Mountain Theory saw this in its own published run in the last week of July 2026: a third-party vendor updated the foundation model driving a demo agent, in a change aimed at making it better at chaining tools together, and the agent began attempting multi-step tool paths it had never tried, improvising raw shell commands instead of the sanctioned scripts, and reaching for the network to answer questions it had previously answered locally. Nobody wrote a malicious prompt. The instructions were ordinary. What changed was the capability.
Can an AI agent change behavior after a model update?
Yes, and Mountain Theory stopped zero-day agent behavior the day it appeared, with no new rule, no signature, no patch. The behavior was novel on the day it ran: no prior incident, no advisory, no sample to write a rule against. Mountain Theory blocked all of it on the day it appeared, without writing a new rule, shipping a signature or a definition update, pushing a patch, retraining anything or subscribing to a threat feed. In that run, 12 of 12 dangerous scenarios completed with nothing in the path, every run, and 0 of 12 completed with Mountain Theory in the path, in any run.
How do you control an AI agent built on someone else's model?
It works with any AI you already use, because it checks the action, not the model. You do not control when a hosted model changes and you may not be told; your prompts, your policies and your infrastructure can be identical from one day to the next while the thing making the decisions is not. Mountain Theory checks each action an agent proposes against policy written in plain English and returns ALLOW, HOLD or BLOCK before the action executes. It asks whether this should be allowed to happen and who authorized it, rather than whether anyone has seen it before, so an action nobody has ever seen is still just an action asking for authority it may not have.
Is it safe to let AI do work on its own?
It runs on its own safely when every action is checked before it runs. AI does not have to be hacked to cause damage; it only has to be wrong while it holds real permissions. In Mountain Theory's published run, four of the 12 scenarios were not attacks at all but ordinary work the agent was supposed to complete, and after a vendor model update all four went off script too. With nothing in the path, every one of them ended the same way the attacks did. With Mountain Theory in the path, none of them did. You choose which actions are worth pausing for a person, and everything else runs at full autonomy.
What proof is there that Mountain Theory actually stops an autonomous AI action?
Tests published, misses included: two recorded runs, both with terminal recordings and both naming the third-party technology involved. In the first, the same 10 actions were run in the same order under three configurations. Ungoverned, 10 of 10 executed. Under NVIDIA OpenShell alone, all 5 sandbox-boundary crossings were denied at the kernel and all 3 in-bounds bad decisions still went through, including a secrets read that printed credentials to the screen. Under OpenShell plus Mountain Theory, those same 3 actions returned HOLD, HOLD and BLOCK, and the secrets read was stopped before it executed, so the credentials never printed. In the second, a third-party provider updated the foundation model driving an autonomous agent. Nothing on our side changed, the agent began attempting multi-step actions it had never tried before, and every attempt was stopped on 30 and 31 July 2026, the days the behavior first appeared. No new rule, no signature, no patch.
Does a FedRAMP authorization or SOC 2 mean a vendor can control autonomous AI?
No. A compliance authorization attests to how a vendor runs its own service: that controls exist, that processes are documented, that evidence is retained. That is real and it matters in procurement. It is not a measurement of whether a product can stop an autonomous agent from taking a specific action, because no compliance regime was designed to test that. A vendor can hold every certification available and still have nothing in the path when an agent decides to delete evidence, disable a control, or read secrets it is technically permitted to read. The only thing that shows an action was stopped is a run where that action was attempted and did not execute.
Does Mountain Theory need policy updates to stop new attacks?
No new rule, no signature, no patch: novel agent behavior was stopped the day it appeared in a published, recorded run, with no retraining and no threat feed. The system runs as a real-time learning loop: every action and every decision feeds it, it rules on behavior it has never seen in the moment, and it decides for itself whether what it learned becomes a new policy, a family of policies, or nothing at all. It has also been demonstrated live. In August 2026 a public university's AI Director and engineering team watched an autonomous agent's breach attempt and tool chaining stopped in the moment, with nothing changed, not even a policy. That demonstration is why the university moved forward with a proof of concept.
Does reporting rogue AI agent activity mean it is under control?
No. Reporting says an agent crossed a line; control checks every action before it runs. On 11 August 2026 more than 120 organizations, including NVIDIA, Cisco and CrowdStrike, proposed the Shared AI Findings Exchange, or SAFE, through the Open Secure AI Alliance with the Linux Foundation. It is an incident reporting framework modeled on aviation safety reporting: collect AI incidents and near misses confidentially, notify the organizations affected, identify the control failures that keep recurring, and publish evidence-based recommendations. That is useful work and the industry needs it. It is also, by design, a record of what already happened. The two questions are separate. One asks what went wrong across the industry last quarter. The other asks whether this action runs right now, and no reporting framework was built to answer it. An enterprise wants both: something to learn from afterwards, and something in the path beforehand.
How should I evaluate competing AI security vendors on evidence?
Ask every vendor for tests published with the misses included, the same four things, and compare the answers side by side. First, the action set: exactly which actions were attempted, in what order. Second, the control condition: what happened with nothing in the path, so there is a baseline to measure against. Third, the outcome per action, including the ones the product did not stop. Fourth, the recording or log. A vendor who publishes all four is making a checkable claim. A vendor who publishes a certification, an integration list or a customer logo is telling you about their process and their distribution, which are different questions. Mountain Theory publishes all four, including the actions it does not have a policy for.
What is AI infrastructure defense?
AI infrastructure defense is security for the moment an AI system acts, not the moment it thinks. It sits between the AI's decision and the action that decision would trigger. Every proposed action is checked against your policy before it reaches the system it would touch. Mountain Theory builds AI infrastructure defense for enterprises.
How do you stop an AI agent from taking a harmful action?
Check every action before it runs and return ALLOW, HOLD, or BLOCK. The same holds for a workflow: each step it tries to take is checked before it runs, so a workflow manipulated mid-run still cannot act outside policy. Filtering the prompt does not help once the model has already decided. Mountain Theory evaluates each action against policy and returns one of three outcomes: ALLOW, HOLD or BLOCK. The action does not execute until it has been checked.
What happens when an AI agent is authorized but wrong?
Authorization is not control: Mountain Theory controls what your AI does by checking each action before it runs. A compromised or manipulated agent uses the exact permissions you granted it, so identity and access controls see nothing unusual. The gap is between what the agent is allowed to do and what it should do right now. Mountain Theory closes that gap by checking each action at the point of execution.
What is the execution layer in AI security?
The execution layer is where an AI system's decision becomes a real action. It is the step after the model produces output and before an API call, a database write, a payment or a message actually happens. Most AI security operates before this point, on prompts and outputs. Control at the execution layer is what determines whether an action occurs.
How is this different from prompt filtering?
No chatbot filter: a filter inspects words, and Mountain Theory checks the action before it runs. Execution control inspects actions. A filter can miss a manipulation, and once the model is convinced, the filter has nothing left to catch. An execution check does not care how the agent was persuaded, because it evaluates the action itself against policy. The two operate at different layers and are not substitutes.
Does this require a human to approve every action?
No. It runs on its own, and a person steps in only where your rules say. HOLD is an option you switch on for the actions you choose, not a requirement. You decide where a person steps in, and everything else is checked and allowed to proceed without waiting on anyone.
How do you write policy without writing code?
Rules in plain English, and no code to change a rule. You describe what the AI is allowed to do, and in what circumstances, in the same language you would use to brief a person. That policy is what each action is checked against.
Is AI agent activity auditable?
Yes. Every decision logged: who, what, when, why, and that record is proof for your auditor. The record is append-only, so it can be used as evidence. This is built for SOC 2, ISO 27001, PCI DSS, GDPR, HIPAA, FERPA, CMMC and CCPA programs.
Which AI models does this work with?
It works with any AI you already use. It sits at the execution layer, so it does not depend on which model produced the decision, or on that model's provider, version or hosting.
Who is Mountain Theory for?
Mountain Theory is enterprise-first. The strongest fit is organizations where an AI acting wrongly has physical or regulatory consequences: public safety and NG911, defense, financial services, healthcare, education under FERPA, and disaster response.
What is a prompt injection attack, and how do you defend against it?
A prompt injection attack hides instructions in content an AI reads, so the AI follows the attacker instead of you. Mountain Theory blocks hidden instructions in emails and documents by checking the action they lead to, before it runs. The content can be a web page, a document, an email or a calendar invite. Defending it by inspecting language alone is unreliable, because the attack succeeds by looking legitimate. The durable defense is at the execution layer: even if the AI is convinced, the action it then attempts is still checked against policy before it runs.
What is agentic AI security?
Agentic AI security is protecting systems where an AI takes actions on its own rather than only producing text. The risk changes because the AI now has permissions, tools and reach into other systems. The control that matters is over the actions it takes, since the same permission that makes an agent useful is what makes a compromised agent dangerous.
Can an AI agent be trusted with production systems?
Yes, when every action is checked before it runs by something outside the agent itself. Trust based on the model behaving well is not a control, because the model can be manipulated and its behavior changes between versions. Mountain Theory places the constraint outside the agent, so the boundary holds regardless of what the agent was persuaded to attempt.
Does Mountain Theory replace my existing security tools?
No. It works with any AI you already use and the tools around it; it covers the layer they do not reach. Identity and access management decides what an AI is permitted to do. Monitoring records what it did. Neither one stops a permitted action that should not happen right now. Mountain Theory sits at that gap and leaves the rest of your stack in place.
How do you prove to an auditor that an AI system is under control?
Proof for your auditor: every decision logged, who, what, when, why, append only. Mountain Theory produces that record as an append-only log, so it stands up as evidence rather than as a report someone assembled afterwards. That is what an auditor asks for under SOC 2, ISO 27001, HIPAA, FERPA and CMMC.
What is inline AI runtime security?
Inline AI runtime security means the control sits in the path the AI actually runs through, rather than watching from the side. If a check is not inline, it can only report what already happened. The distinction that matters is where inline sits: some products are inline on the prompt and the response, and some are inline on the action. Mountain Theory is inline on the action, between the decision and the thing that decision would do.
What is an AI firewall?
An AI firewall inspects traffic to and from a model and blocks content that breaks a rule. It is a content control: it looks at what goes in and what comes out. It does not evaluate the action a model then takes, because by that point the traffic has already passed inspection. An authenticated agent issuing a destructive command is not a content problem, so a firewall is the wrong layer to stop it.
Do I need AI guardrails or execution control?
Mountain Theory controls what your AI does; guardrails filter what a model says. Most enterprises need both. Guardrails stop a model from saying something unsafe. Execution control stops an agent from doing something unsafe. A jailbreak filter does not stop an authenticated agent from deleting a database, because nothing unsafe was said. If your AI only produces text, guardrails may be enough. If it takes actions, they are not.
What is non-human identity (NHI) security?
Non-human identity security governs the credentials that machines use: API keys, service accounts, OAuth tokens and now AI agents. It answers who an agent is and what it is permitted to do. It is necessary and it is upstream of the problem here. Identity solves attribution, and it authorizes the agent once at the start of a session. It cannot help when a correctly identified agent, with valid credentials, does the wrong thing.
What is AI security posture management (AI-SPM)?
AI security posture management discovers your AI assets, maps their risk, and reports what is misconfigured or exposed. It gives you the inventory and the risk picture. It is a visibility layer, so it tells you what your exposure looks like rather than intervening in the moment. Posture answers what could go wrong. Execution control answers what happens when it does.
What is MCP security?
MCP security protects deployments of the Model Context Protocol, the standard that lets AI models call external tools and data sources. The risk is that MCP hands an agent real reach into real systems. Securing the protocol matters, and so does governing the action once a tool call is made. Mountain Theory checks the action itself against policy, regardless of whether it arrived over MCP, an API, or a framework calling a function directly.
Is AI red teaming enough to secure an AI system?
No. Red teaming tests a model on one day; control checks every action before it runs, every day. Red teaming is still worth doing. It is testing, so it tells you what an attacker could achieve at a point in time, against the model as it was that day. It does not stop anything in production. Models change, attackers adapt, and a finding does not become a control until something enforces it at runtime.
What is an AI gateway?
An AI gateway brokers traffic between users and models, usually to apply data loss prevention, masking, or access rules at the boundary. It works at the perimeter, between the person and the model. That is a useful place to protect data. It is not where an autonomous agent acts, because an agent operating inside your systems is already past the perimeter when it decides to do something.
What is deterministic policy enforcement for AI?
Deterministic policy enforcement means the same action against the same policy always produces the same decision, with no model inference in the decision path. It matters because a probabilistic control cannot be audited: you cannot show a regulator a control that might behave differently next time. Mountain Theory is deterministic at the point of enforcement, and the policy behind it is written in plain English rather than code.
What is the difference between AI governance and AI security?
AI governance is the policy, documentation and oversight that says what your organization permits. AI security is what actually enforces it. Governance produces the rule and the evidence trail. Without enforcement it is a document, because nothing stops the action when the moment comes. Mountain Theory is the enforcement half, and it produces the evidence governance needs as a byproduct.
What is an AI circuit breaker?
An AI circuit breaker sits between an AI system's decision and the action it would trigger, and stops the action when it breaks policy. The name comes from electrical engineering: the breaker does not judge the appliance, it opens the circuit when current crosses a threshold. Applied to AI, it means the action does not execute until it has been checked. That is the architecture Mountain Theory is built on.