The RSAC framing here is spot on. The core issue with agentic AI security is that traditional perimeter-based thinking doesn't map to systems that autonomously decide what to do next. An agent with tool-use capabilities is essentially a programmable actor with the blast radius of whatever permissions it holds. The practical gap I keep seeing: most teams bolt on security after the agent is already running in production. But the threat model needs to happen at design time — what can this agent access, what's the maximum damage from a single misrouted action, and how do you audit a chain-of-thought that led to a destructive tool call? Sandboxing, least-privilege scoping, and human-in-the-loop gates for irreversible actions should be table stakes for any agent deployment.
The RSAC framing here is spot on. The core issue with agentic AI security is that traditional perimeter-based thinking doesn't map to systems that autonomously decide what to do next. An agent with tool-use capabilities is essentially a programmable actor with the blast radius of whatever permissions it holds. The practical gap I keep seeing: most teams bolt on security after the agent is already running in production. But the threat model needs to happen at design time — what can this agent access, what's the maximum damage from a single misrouted action, and how do you audit a chain-of-thought that led to a destructive tool call? Sandboxing, least-privilege scoping, and human-in-the-loop gates for irreversible actions should be table stakes for any agent deployment.