THE QUESTION, ANSWERED
HOW DO YOU SECURE AUTONOMOUS AI AGENTS IN AN ENTERPRISE?
Give every agent an identity and the least access it needs, then check every action it proposes before it runs, against rules written in plain English by whoever owns the risk, and return ALLOW, HOLD or BLOCK. Identity says who the agent is. The check says whether this action, right now, runs. An enterprise needs both, and most have only the first.
What the guidance already says
The OWASP AI Agent Security Cheat Sheet and the NIST AI Risk Management Framework agree on the shape: treat each agent as a non-human identity with its own credentials, scope its tools and permissions to the task, require approval for consequential actions, keep an inventory, and log what it does. Microsoft, Google and the cloud providers say the same thing in their own words.
Do all of that. It is the floor.
Where the guidance stops
Identity and least privilege decide what an agent may reach. They do not decide what it does with the reach once it has it. An agent with legitimate write access to the vendor system can still delete the evidence it was told to clean up. An agent whose model was updated overnight can still use permissions it already held in ways nobody planned. The gap is the moment between the agent deciding and the system executing, and none of the identity controls sit there. Where that point is.
What an enterprise program looks like
- Inventory the agents and what each can reach. Models, frameworks, coding agents, platform agents. The systems that can be governed.
- Give each one an identity and the least access for its task. The identity vendors do this well. Keep them.
- Put a check between every decision and its execution. Every action, not the first one, because a blocked agent tries another route.
- Let the risk owners write the rules, in plain English. The treasurer writes the payment rule. The compliance lead writes the evidence rule. No code to change either.
- Use three outcomes. ALLOW runs it. BLOCK stops it and the workaround. HOLD parks it for a named person, only where the rule says. Why the check catches drift that dashboards miss.
- Keep the record your auditor will ask for. Who, what, when, why, written before the action runs. What that record has to contain.
What it looks like when it works
Optimo AI runs a vendor-review agent that drafts, summarizes and recommends on its own and stops for a person only where the rules say: writing to a system of record, committing the business, reaching outside. When it was told to remove old evidence, the deletion did not run, the retry through a second tool did not run, and the reviewer saw both in the record. The Optimo AI proof of concept, signed off by its CEO. Every published run, misses included, is at the proof page.
Common questions
Does this require a human to approve every action?
No. It runs on its own, and a person steps in only where your rules say. HOLD is an option you switch on for the actions you choose, not a requirement. You decide where a person steps in, and everything else is checked and allowed to proceed without waiting on anyone.
What is non-human identity (NHI) security?
Non-human identity security governs the credentials that machines use: API keys, service accounts, OAuth tokens and now AI agents. It answers who an agent is and what it is permitted to do. It is necessary and it is upstream of the problem here. Identity solves attribution, and it authorizes the agent once at the start of a session. It cannot help when a correctly identified agent, with valid credentials, does the wrong thing.
Which AI models does this work with?
It works with any AI you already use. It sits at the execution layer, so it does not depend on which model produced the decision, or on that model's provider, version or hosting.
More answers
The product, if you want it
Mountain Theory is the check described above, shipped. It works with any AI you already use, in your environment or the cloud.