Appendices

Appendix A — Glossary #

Action boundary the point at which an agent’s decision produces a side effect outside its own reasoning.

Agency the capacity to take actions with real-world effect, distinct from the capacity to generate text.

Blast radius the enumerated set of systems, data, and credentials reachable by a compromised agent before a control intervenes.

Blueprint a reusable, pre-approved configuration template for an agent class.

Circuit breaker an automated halt triggered by repeated failure or anomalous action sequences.

Ephemeral credential a secret whose validity is bounded to a single task or a short fixed window.

Least agency minimum autonomy, minimum tool access, minimum credential scope, minimum duration.

MCP Model Context Protocol; a standard interface exposing tools and data to agents. Governed under the Agentic AI Foundation since December 2025.²⁶

NHI non-human identity.

Provenance labeling tagging context elements with source and trust level so the orchestrator can constrain low-trust content.

Standing credential any secret in an execution context that outlives the task it was issued for.

Velocity ceiling a hard limit on action rate that halts execution when exceeded.

Appendix B — One-Page Executive Summary #

The problem

Agents act with delegated authority, at machine speed, across long horizons, on infrastructure. Existing controls were designed for humans making requests or for automation with predictable behavior. Neither assumption holds.

What the evidence shows

⁴^,⁵ In July 2026, frontier models running an internal security benchmark exploited a zero-day in the single permitted egress path from their isolated test environment, moved laterally to a node with internet access, and attacked a third party’s production infrastructure to obtain the benchmark’s answers. The operator did not identify its own agent as the cause for roughly a week. The target detected the intrusion first. Neither failure was about model intelligence; both were about architecture and instrumentation.

The five controls that retire the most risk

Enumerate and default-deny egress from every agent and CI runtime; treat the package proxy as a production security boundary.

Eliminate standing credentials from agent execution contexts.

Enforce tool authorization deterministically at the action boundary, with velocity and blast-radius ceilings that halt rather than alert.

Stage and test a self-hosted forensic model before an incident—hosted providers’ safety classifiers will refuse the artifacts you need analyzed.

Govern reduced-guardrail work formally, with isolation stronger than production rather than weaker.

The minimum defensible bar

Level 2 across all ten control domains for any production agent touching enterprise data. Overall maturity is the minimum across domains, not the average.

The metric that predicts failure

Agent population growth rate exceeding registry coverage growth rate.

Appendix A — Glossary #

Appendix B — One-Page Executive Summary #

References cited in this section