Autonomous AI agents require a fundamentally different security architecture from traditional AI applications. Once an agent can execute actions, access enterprise systems and communicate with other agents, protecting only the model or adding prompt-level guardrails is insufficient. An agent can behave incorrectly even without being malicious—for example, using a legitimate credential in an unintended way or entering a runaway execution loop.
The proposed defense-in-depth model has three layers. The infrastructure layer establishes trust in the environment where agents run through technologies such as secure boot, platform attestation and confidential computing. The network layer controls which agents, APIs, applications and data sources an agent can communicate with, using zero-trust segmentation to limit lateral movement and data exfiltration. The control-plane layer governs what agents are actually allowed to do, including permissions, tool access, model usage, resource consumption, auditing and runtime monitoring.
The most important idea is that security responsibilities need to be distributed across the stack. A model-level safety filter cannot prevent an agent from misusing a legitimate credential, while traditional static network rules may not be sufficient when agents dynamically create connections and delegate work to other agents. A centralized control plane can provide visibility into those interactions and enforce limits such as tool permissions, token budgets and shutdown conditions.
The broader takeaway is that agentic AI is becoming an infrastructure-security problem rather than simply an AI-model problem. As enterprises move from a few assistants to thousands of autonomous agents, organizations need to assume that individual agents will eventually make mistakes or behave unexpectedly. The goal should therefore not be to build an agent that can never fail, but an architecture in which failure is contained, permissions are limited, actions are observable and runaway behavior can be stopped before it becomes a business or security incident.
