Section 5

Trust, security and resilience

Cybersecurity is the trust layer that makes a control plane safe to operate. Many enterprises still modernize against yesterday’s security model, and risk management often remains a separate function.¹ Only 37% of CISOs report a deep, trusted relationship with the CTO, and 22% with the chief architect,³⁸ even as generative AI, the foundation of today’s agents, opens new attack surfaces through prompt injection, data poisoning, hallucination and adversarial attacks.³⁹ The control plane therefore needs controls that run continuously, from deployment onward. It has to know which human or machine is acting, enforce guardrails at runtime, validate outputs and their provenance, and isolate compromised paths, all while keeping auditable records of who acted, on whose authority and under what conditions.¹

In the World Economic Forum’s Global Cybersecurity Outlook 2026, 94% of leaders named AI the most significant driver of cybersecurity change and 87% identified AI-related vulnerabilities as the fastest-growing cyber risk, while the share of organizations assessing AI tools’ security before deployment rose from 37% to 64%.⁴⁰ Earlier research found risk and regulatory compliance to be the top two concerns in scaling generative AI.³⁹

Extend identity and authority beyond human users

An agentic enterprise needs an identity fabric that extends identity and access management to agents, devices, workloads and services,^1,41 anchored in cryptographic identity and explicit authority so that every actor is traceable and none is implicitly trusted. Agents should not receive default entitlements or inherit a user’s full identity. Access should be delegated explicitly, limited to the task and bounded by time, data, authority and risk.^1,42 Authentication and authorization should stay distinct, with verification attached to the moment of action.¹

The platforms are moving in this direction. Google’s Agent Identity, for example, is a first-class principal type, distinct from human identities and service accounts, built on the SPIFFE standard and cryptographically attested.⁴¹ The Cloud Security Alliance shows why short-lived, task-scoped credentials matter.⁴³ When 100 concurrent agents finish two-minute tasks while holding standard 15-minute tokens across 1,000 daily cycles, stolen credentials stay valid for about 21,666 agent-hours a day after the work is done. Its recommended pattern gives each agent instance a unique identity and scopes tokens to the task with short lifetimes. The pattern also binds tokens to a key, validates every request and supports revocation by token, agent, task or delegation chain.

Identity is also where attackers already concentrate. Microsoft’s Digital Defense Report 2025⁴⁴ found identity-based attacks up 32% in the first half of 2025, with more than 97% of them password attacks, and reported that phishing-resistant multifactor authentication blocks over 99% of such attempts. Attackers increasingly sign in rather than break in, which is why agent credentials must be short-lived, bound and auditable.

Standards work gives this a vendor-neutral shape. The National Cybersecurity Center of Excellence at NIST has proposed a project on software and AI agent identity and authorization, focused on identifying, authorizing and auditing agents, on non-repudiation, and on controls against prompt injection.⁴⁵ An IETF draft on AI agent identity builds on workload identity such as SPIFFE, short-lived credentials bound to a key, OAuth delegation and token exchange, and real-time revocation through the OpenID Shared Signals Framework, and it calls static API keys “an antipattern for agent identity.”⁴⁶ Both are drafts and will change. Still, they give security teams a vendor-neutral checklist, covering a unique identity for each agent, delegated authority that narrows at each hop, auditable actions, no static keys, and revocation that takes effect in real time and so gives the kill switch a second path. The platforms are converging on the same pattern. Microsoft Entra Agent ID gives each agent its own identity, and Google distinguishes agents that act as their user, as themselves or under delegated authority.^12,47

In MuleSoft Agent Fabric, Trusted Agent Identity lets agents act with a specific user’s identity and authorization so every interaction is secure and auditable, with mobile approval before high-risk actions such as moving money.²¹ Gateway policies apply authentication, rate limits and token bounds consistently across LLM and MCP traffic.

Establish AI-specific runtime controls

Systems that act continuously across models, tools, networks and edge locations need more than perimeter security.^1,44 Zero trust is evolving toward adaptive runtime control, which separates traffic by use case, isolates higher-risk paths and lets one compromised edge be pulled without disrupting core services.¹ Each hand-off between model providers adds exposure, so a model gateway that enforces consistent guardrails and logs every model interaction becomes a core control. As one US bank executive put it, the aim is to “detect, decide, and respond faster than the attacker.”¹ Agent Fabric’s unified LLM and MCP gateway and its Agent Kill Switch provide these runtime controls for agent traffic that flows through MuleSoft.²¹

Map threats to controls

Security teams will judge the control plane against the threat lists they already use. The OWASP Top 10 for Agentic Applications, published in December 2025, names ten risks, and the table maps each to the controls that address it.⁴⁸

Microsoft’s AI Red Team added seven agentic failure modes to its taxonomy in June 2026, among them agentic supply chain compromise, inter-agent trust escalation, session context contamination and MCP and plugin abuse, and its mitigations include an agent bill of materials that covers MCP servers, signature and provenance checks with pinned versions, and rejecting self-asserted roles at hand-offs.³⁷ MITRE ATLAS has added agent-specific techniques since December 2025, such as AI Agent Tool Credential Harvesting and Publish Poisoned AI Agent Tool.⁴⁹ Tag red-team scenarios with these names so results map to a shared vocabulary. The supply chain risk in what enters the registry and the trust risk in what approvers are shown each need a named owner, because no gateway closes either alone.

Modernize the cryptographic foundation

Quantum computing is expected to weaken today’s asymmetric cryptography (RSA and elliptic-curve), and adversaries can harvest encrypted data now to decrypt later.^1,50 For US federal systems, the timeline is now set by policy.⁵⁰ On June 22, 2026, a US executive order, “Securing the Nation Against Advanced Cryptographic Attacks,” directed federal agencies to move high-value and high-impact systems to quantum-resistant key establishment by December 31, 2030 and to post-quantum digital signatures by December 31, 2031, and directed the FAR Council to propose, within 180 days, a rule requiring covered contractors to meet NIST’s post-quantum standards by the end of 2030.^51,52 NIST finalized its first post-quantum standards, including ML-KEM (FIPS 203) and ML-DSA (FIPS 204), in August 2024.⁵³

AI is also shortening the path from theoretical weakness to practical attack. In July 2026, Anthropic reported that its Claude Mythos Preview model had found new attacks against a weakened, seven-round version of AES and against HAWK, a candidate post-quantum signature scheme, and the AES attack is 200 to 800 times faster than the best earlier human-developed attack.^54,55 The findings did not affect deployed standards, but they show why cryptographic agility matters.

Post-quantum migration belongs in the foundation to build now for digital trust. Map where asymmetric encryption is used, start with the most critical data and transactions, and upgrade in phases.¹ The program needs board oversight and ownership across functions instead of being left to the security team.^56,57 Few companies are ready, according to a 2026 board discussion guide from the National Association of Corporate Directors and the Internet Security Alliance, which cites Bain research finding roughly 90% of companies unprepared for quantum threats and an ISACA study finding only 4% with a defined quantum strategy.⁵⁷ For the control plane itself, build crypto-agility into gateways and service meshes so algorithms can be swapped as standards and threats evolve.

Govern output integrity and protect human judgment

Trust has to extend beyond access and model performance to the outputs agents produce and the decisions that follow. The control plane should verify provenance, validate outputs continuously and detect behavioral anomalies across models and agents, catching inaccurate, manipulated or out-of-policy results before they influence a human decision or reach a customer.¹ The same controls reduce automation bias and keep human judgment central where it matters most. AI-native banking products show where this is heading, with governance built into the product itself, autonomy granted by permission, and customers able to review and override decisions.⁵⁸ Human judgment also has to be usable in practice. The people who oversee agents need the time, information and authority to override or stop them,³² and drills should show that they can.

Research is converging on how to measure this. The TRiSM review published in AI Open⁵⁹ adapts AI trust, risk and security management to multi-agent systems across explainability, ModelOps, security, privacy and lifecycle governance. It proposes a risk taxonomy that runs from coordination failures to prompt-based manipulation, and two metrics: a Component Synergy Score for inter-agent collaboration and a Tool Utilization Efficacy measure for whether tools are used correctly and efficiently.

In MuleSoft Agent Fabric, Agent Visualizer adds confidence scores, bottleneck detection and hallucination-risk signals across the agent network.²¹ The evaluation itself can run on any tool that generates test scenarios, scores outcomes against success criteria and surfaces failures before production.

Evaluation runs through the whole life of an agent. Test against success criteria before promotion, score a sample of production traces continuously, and keep a standing red-team suite, tagged to the threat lists in this section, whose results feed tier decisions (Section 4). Evaluate the trajectory as well as the final answer, meaning which tools the agent chose and in what order.⁶⁰ In a large public red-teaming competition run with NIST’s Center for AI Standards and Innovation, more than 250,000 attack attempts from over 400 participants found at least one successful hijacking attack against every one of the 13 frontier models tested.⁶¹ Evaluation tooling is available from more than one vendor. AWS AgentCore Evaluations offers online evaluation of sampled live traces and on-demand tests for CI/CD pipelines,⁶² and Microsoft describes ASSERT, an open-source framework that turns behavior specifications into evaluations, alongside portable runtime policies for which tools and actions agents may use.⁶³ Whichever tools produce the results, record them in the registry so that promotion decisions rest on them.

Human takeover after the kill switch

Stopping an agent is only part of the job, because people still have to pick up the work it was doing. BCG advises defining “clear protocols for human workers to take over should the agents need to be taken offline,” and deciding in advance where agents may not go at all.⁶⁴ Write the takeover runbook before the first agent reaches tier 3:

• Stop. The kill switch or credential revocation blocks new actions. Rules set in advance for each tool say whether an action already in flight completes, rolls back or is parked.
• Hand over. Open work moves to a named team’s queue with what the agent knew: its trace, pending actions and approvals, and the data it touched.
• Continue. The process runs in a defined degraded mode, manual or deterministic, with its own service levels, until the agent returns.
• Recover. Find the cause, re-evaluate the agent and bring it back one tier at a time (Section 4).

Then rehearse it, because people tend to trust what AI produces. In a global study of more than 48,000 people, 66% of employees who use AI at work said they rely on its output without evaluating its accuracy, and 56% said they had made mistakes in their work because of AI.⁶⁵ Organizations are adding checks, and in KPMG’s first-quarter 2026 pulse, 63% required human validation of agent outputs, up from 22% a year earlier.⁸ Review helps only when people have the time, information and authority to act (Section 4). A takeover drill tests all three, and its timing belongs in the scorecard (Section 9).

When agents can move equipment

In energy, utilities, manufacturing and other operational technology (OT) settings, an agent’s action can change a compressor’s load, open a valve or re-route power. There the control plane governs what agents may request, but it is not the last line of defense. Independent safety layers (safety instrumented systems, emergency shutdown systems, hardwired interlocks and relief devices) must be able to act whatever an agent does, under the process-safety discipline that standards such as IEC 61511 set out,⁶⁶ and they stay outside the agents’ reach. Current guidance from US, Australian and allied cybersecurity agencies is explicit: people remain responsible for functional safety, AI should not actively control OT without a human in the loop, and AI systems need failsafes so they fail gracefully without disrupting critical operations.⁶⁷

For any agent that can reach equipment, these design rules follow:

• Keep agents out of the control network. Agents run in the enterprise zone or the industrial DMZ and reach control systems only through defined conduits, in line with the ISA/IEC 62443 zone-and-conduit model and NIST’s guide to OT security.^68,69
• Agents propose and people with authority approve. Each approval is bound to the exact change and valid for minutes, not hours, and the control system still enforces its own engineering limits.
• Limit cumulative change as well as each step. Caps on cumulative change apply across requests, agents and sessions, so many small approved moves cannot add up to one nobody checked.
• Fail to the engineered safe state. When data goes stale or a connection drops, agents fall back to advice only and the process falls back to the safe state that process-safety engineering defines, which is not always “stop.”

Under the EU AI Act, AI systems used as safety components in the management and operation of critical infrastructure, including the supply of water, gas, heating and electricity, are high-risk, so the oversight requirements above apply to them.³² Reference use case 3 (Section 13) applies these rules to a natural gas pipeline operator.

Plan for shadow agents

Security researchers point to a newer risk: personal agents entering the workplace. The open-source OpenClaw agent, which spread rapidly in early 2026, runs on a user’s own machine, where it can run commands, read and write files and hold credentials, and one security vendor found employees using it at 22% of its customers.^70,71 Bans alone tend to push usage underground. A more durable approach makes the governed path the easy one, with a registry, a gateway and sanctioned capabilities that agents can use safely, and endpoint and identity controls for anything that runs outside them. Decoys help find what inventories miss. Honeytoken credentials, canary documents and decoy MCP tools should never be touched by a sanctioned agent, so any use of them flags an agent working outside the governed path. A custom gateway policy family can plant and watch such decoys (Section 7).

Map the design to the standards auditors use

Compliance and audit teams will map any control plane to the frameworks they already report against. Doing it once shows that the design is standards-based rather than vendor-led, and it saves each program the effort. Appendix C maps the control plane to three of them:

• ISO/IEC 42001, the AI management-system standard, with ISO/IEC 42005 for impact assessments.⁷²
• The NIST AI Risk Management Framework.⁷³
• The EU AI Act’s requirements for high-risk systems.³²

The Cloud Security Alliance’s AI Controls Matrix maps 247 control objectives in 18 domains to ISO/IEC 42001, the NIST AI RMF and the EU AI Act, with guidance for each role from model provider to AI customer.⁷⁴ Singapore’s Model AI Governance Framework for Agentic AI, published in January 2026, asks organizations to bound agents’ autonomy and access to tools and data up front and to define the checkpoints where human approval is required.⁷⁵ The standards also connect to the autonomy tiers, since an up-to-date impact assessment is part of the evidence for promoting an agent (Section 4).