Most conversations about agentic AI security start and end with prompt injection. A recent O’Reilly AI Superstream, Securing Agentic Systems, argued that this is only the first of several layers. Andreas Welsch, an Agentic AI leadership expert, moderated the event and, as he explained in his opening, has spent recent months building a multi-agent, always-on business operating system, which made the question of how to build security in a practical one.
He framed the day around news from the summer, when AI labs reported agents that apparently escaped a sandbox and attacked other sites. For leaders who are about to give agents real tools and real data, the sessions answered a plain question: what has to be true before an agent is allowed to act?
This article summarizes what six speakers said, with every claim attributed to the person who made it. Two themes run through it: layered security, and the shift to agentic commerce. Statements about third parties, such as named incidents and figures, are reported as the speakers stated them and have not been independently verified.
Executive Summary
- Sagar Rao of AWS described five layers that limit what an agent can do, whether or not anyone fools the model.
- Sandy Subramani of AWS showed runtime steering that deterministic code enforces inside the agent loop.
- Vicki Raiselman of Akamai said agent traffic must move from sessions to verifiable mandates, checked at the edge.
- David Campbell introduced BICO: behavior, identity, control and observability.
- Frank Geisler of GDS Business Intelligence argued that agents need their own identity and least privilege.
Key Takeaways
- Prompt injection defenses lower the odds of an attack. Layered controls lower the damage, Sagar Rao said, and a team needs both.
- Rao said an agent should act as the user, with short-lived credentials scoped to one task.
- Subramani said prompts and skills are only suggestions, while code in the agent loop can enforce a rule.
- Raiselman said most agent traffic is unsigned today and that abuse often sits in the sequence of steps, not in any single request.
- Campbell said model safety is not system security, and that the identity, control and observability layers carry the heavy lift.
- Geisler said permission to read data is not permission to disclose it.
- Welsch closed the day with a line from his preparation: for security teams, the question is not if something happens, but when, and what the impact will be.
What is agentic AI security?
Agentic AI security is the set of controls that limit what an AI agent can read, decide and do on behalf of a person or a business. It covers who the agent acts for, which tools it can reach, which actions need a human, and what record exists afterward. It differs from chatbot safety because an agent takes actions with real credentials, so the worst case is no longer a wrong answer but a wrong transaction.
Layered security: five answers to five stages
Sagar Rao, a senior technical account manager at AWS, split an agent architecture into an untrusted zone (everything the agent reads), a trusted zone (the agent and model) and a privileged zone (the keys and tools). Between them sit a content boundary and an authority gate. He walked through five stages of a breach: foothold, ask, reach, action and exit, and paired each with a control.
Identity binding and authorization at the tool gate
Rao said the first defense is to tie the agent to the user, so every tool call carries the user’s identity and short-lived credentials scoped to one task. His second layer is authorization at the tool gate. In his words, the rule is simple: if the user could not do it directly, the agent should not be able to do it for them.
When a participant asked about access tokens versus keys, Rao said the method matters less than binding the request to a user identity and narrowing it to the tools that user may access. Asked about service accounts, he said they are not a no-go, but they need an allowlist, limits on write and delete operations, and a human gate.
Key Insight: Rao said the agent should never be asked whether it has the key. The authority gate should ask whether this action is allowed for this user, for this task.
Tool scoping and action gating
Rao described the third layer as one purpose per tool, with narrow inputs and filtering at the data layer. The fourth is an action gate in front of anything irreversible or external, with human approval for critical steps. He added that small, reversible work should not wait for a person, because constant approvals train people to click yes. He also mentioned small decision models that score a proposed action, and cautioned that they help the gate judge but must never decide who is allowed.
Tamper-proof traces outside the agent
The fifth layer is a reconstructible record of who asked, what the agent read, what it decided and which tools it called, stored where the agent cannot change it. Rao said that when an agent goes wrong, a team should freeze it first, then check whether the record is complete. If it is not, he said, a team should assume the worst about what the agent touched.
Key Insight: Rao said no single layer is enough. Each layer assumes the one before it can be bypassed, which is why the stack works even when someone tricks the model.
Steering inside the loop
Sandy Subramani, a senior developer advocate at AWS, added a layer inside the agent. She described a prompting treadmill, in which teams add ever more urgent lines to a system prompt, and noted that prompts and skills remain suggestions. With Strands Agents, an open source framework, hooks let a team run deterministic code at points in the loop, and steering can proceed, guide or interrupt an action. In her pizza-order demo, a five-pizza limit held no matter how the customer phrased the request.
Her advice on scope: start with sandboxed, focused agents and the use case with the best return, then expand.
What the speakers added about identity and control
David Campbell, an AI security leader, presented the BICO framework from a forthcoming book on securing AI systems. BICO stands for behavior, identity, control and observability. He walked through a support agent that reads a poisoned attachment, queries an internal knowledge base and emails the result out. Every step was permitted, he said, and the harm came from the chain.
Campbell said the control layer should be deterministic software that a model cannot talk around, and that observability, meaning replayable traces, is what lets a team automate a kill switch. He said model safety is not system security.
Frank Geisler, founder of GDS Business Intelligence, described three identities in play: the human user, the agent workload and the tool or service. He compared agents to interns who should not receive administrative access. His rule: the model proposes, and trusted code decides. He added that access to data does not mean permission to disclose it, and that approvals should bind to one verified action with an expiry.
Key Insight: Geisler said the malicious instruction may survive, but the forbidden action must fail. Design controls around the second part.
Udita Patel, a senior applied scientist at Amazon, opened her session by naming three ways an agent goes off script: prompt injection, hijacking and goal misalignment. The source text of her session is partial, so this article does not summarize further.
Agentic commerce: signed lanes and mandates
Vicki Raiselman, a senior solution engineer at Akamai, shifted the lens from building agents to receiving them. She said agents do not just browse, they act, and that this breaks the old bot-or-human question. Her replacement is three questions: who is behind the agent, what does it want, and should it be allowed to act.
She said close to half of agentic traffic she sees touches commerce, and that agents browse far more than they buy for now. She cited Visa statistics showing a rise of about 25 percent in malicious bot-initiated transactions. Most agent traffic, she said, is unsigned today.
Her central point was that abuse hides in sequences. Using a concert-ticket example, she described an agent with valid permissions that buys hundreds of tickets across many sites when its owner needed two. Each request looks legitimate, so the control has to limit scope, price, session and quantity.
Key Insight: Raiselman said trust needs to move from a session to a mandate: who is acting, on whose behalf, what was authorized and its limits, and under what evidence.
Verification at the edge
Reyzelman pointed to RFC 9421, on HTTP message signatures, as a stable foundation under the competing agent protocols. She listed six proofs of agentic trust: agent, principal, authority with an expiry, integrity, containment and record. She said to verify at the edge rather than send traffic to the origin, and not to build separate sites for agents.
She reported that Shopify already gives signed agents higher rate limits while challenging unsigned ones, which she called a signed lane and an unsigned lane. She also relayed findings from her colleagues at Akamai that 186 of 2,500 agent skills they reviewed were malicious, and said a backdoored LiteLLM package was pulled 47,000 times in three hours. Those figures are hers, not independently checked here.
Trust as the new conversion metric
Reyzelman said conversion rate and the shopping cart have long been the central measures in commerce, and that the agentic experience puts both up for grabs. She said trust is the most important thing in commerce. Read together with the security sessions, the implication for retailers is that a business which can verify and welcome signed agents may convert agent demand that others turn away.
Welsch added from the moderator’s chair that websites were designed for humans and that agents do not care about color, only whether the information is readable and actionable. He noted that the same companies appear in several of the competing protocol consortia.
Leadership Implications
- Bind every agent to a user or an owner, with short-lived, task-scoped credentials, before it touches production data.
- List each tool, name the task that needs it, and remove everything else.
- Put a human gate in front of irreversible and external actions, and keep it out of low-risk work.
- Store traces outside the agent, and decide in advance how you would freeze it.
- If you sell online, find out how much agent traffic is signed and what experience you offer it at the edge.
Why this conversation matters
Welsch closed by noting that the sessions kept returning to multiple layers, not one control. When he questioned David Campbell, he observed that the answers rely on proven mechanisms, not on anything as revolutionary as some vendor pitches suggest. Campbell agreed, saying the field benefits from returning to cybersecurity basics. For AI leaders, that is a useful signal: governance of agents is mostly disciplined engineering and clear ownership, which links to Welsch’s broader work on AI governance and agentic AI adoption.
Conclusion
Agentic AI security is a stack of controls that assume failure and limit damage, and for businesses that sell online it now includes deciding which agents to trust. The speakers differed in detail, but they agreed on the direction: identity first, narrow tools, deterministic gates, human approval for what matters and a record the agent cannot edit.
Related Reading
- 5 AI Governance Controls Auditors Expect to See
- Agentic AI Pilots: From Prototype to Business Value
- How to Evaluate SaaS Vendors on AI Governance and Risk
- RFC 9421: HTTP Message Signatures
- OWASP GenAI Security Project
- EU Artificial Intelligence Act
Frequently Asked Questions
What are the five layers of agentic AI security?
Sagar Rao named identity binding, authorization at the tool gate, tool scoping, action gating with human approval, and a tamper-proof trace kept outside the agent. Together they limit what an agent can do even when a prompt injection succeeds.
Why is prompt injection defense not enough?
Rao said injection defenses lower the odds of an attack while layered controls lower the damage. A determined attacker may still get through, so the surrounding stack decides how much harm follows.
What is the BICO framework?
David Campbell described BICO as behavior, identity, control and observability. Behavior is the model, identity is whose authority the agent uses, control is deterministic enforcement in the environment, and observability is replayable evidence of what happened.
What is runtime steering for agents?
Sandy Subramani described steering as just-in-time guidance inside the agent loop. Code can let an action proceed, guide the agent back, or interrupt it, which enforces a rule instead of suggesting it.
What is an agent mandate?
Vicki Raiselman said a mandate records who is acting, on whose behalf, what was authorized with its limits, and under what evidence. It replaces trust in a session with trust in a defined, expiring authority.
What is the difference between signed and unsigned agent traffic?
Raiselman said signed agents prove who is behind them, using standards such as HTTP message signatures, and unsigned agents do not. She said most agent traffic is unsigned today, and that Shopify already treats the two differently.
Should an AI agent have its own identity?
Frank Geisler described three identities: the user, the agent workload and the tool or service. He said agents should be treated like employees with least privilege, and David Campbell added that agent identities must not be overprivileged.
Where should a business leader start?
Rao suggested listing every tool, naming the task that needs it, and comparing what the task needs with what the user may do and what the agent holds. The gap between those is the first thing to close.