AI Agent Security

Audience: Platform engineers, AI governance owners, security architects
Time: ~10 min read

Prerequisites: A deployed Control Plane with at least one Bouncer registered; AI Pilot enabled for your environment. Familiarity with AI Access Controls is helpful but not required.

Control Core AI Pilot acts as a real-time policy gateway in front of AI agents and the APIs they call. Unauthorized tool invocations, out-of-scope API requests, and high-risk actions are blocked or stepped up before traffic reaches downstream systems. The same gateway can reduce token spend by caching identical model responses at the Bouncer layer — without changing agent application code.

MVP value proposition

Outcome	How AI Pilot delivers it
Stop unauthorized agent actions	Rego controls evaluate every agent request at the Bouncer (Policy Enforcement Point) using framework identity, declared scopes, and live PIP context.
Contain high-risk operations	Deny, mask, or require human approval for sensitive tool calls and API mutations — enforced inline, not after the fact.
Reduce token cost	Gateway-level response caching (`pilot_token_model_cache`) serves repeat prompts without a round trip to the model provider.

The agent application stays policy-blind: the Bouncer normalizes traffic, policy engine decides, and the Bouncer enforces. No parallel authorization logic belongs in the agent codebase.

End-to-end workflow

Click to enlarge

Step 1 — Register the agent (~3 min)

Open AI Pilot → AI Agents and register each non-human identity (NHI) agent your organization runs — for example LangGraph, LangChain, Salesforce Agentforce, or Microsoft Foundry agents.

Capture:

Framework — how the agent identifies itself to the Bouncer
Declared scopes — tools, APIs, and data domains the agent is allowed to touch
Environment — sandbox first, then production after validation

Troubleshooting: If the agent does not appear after registration, confirm agent traffic routes through a registered Bouncer and that the Bouncer heartbeat is fresh in Settings → Bouncer Management. Common causes: agent bypasses the Bouncer, wrong upstream host, or environment mismatch. See AI Pilot Troubleshooting.

Step 2 — Observe (~5 min)

Leave the agent in observe mode while AI Pilot records tool calls, model usage, and decision metadata. Review activity in AI Pilot → Activity and the Audit tab before enforcing.

This shadow period surfaces scope drift — tools or APIs the agent touches that were not declared at registration.

Step 3 — Protect this Agent (~10 min)

Select Protect this Agent on the registered agent row. Smart Control Core (Smart CC) opens with seeded agent_context (framework, scopes, privilege score) and proposes a draft control tailored to that agent.

Smart CC never auto-activates. A human control author must:

Review the draft in Controls Manager (Visual Builder or Rego editor)
Run the Simulator against recent agent traffic
Promote and activate the control to sandbox, then production

Troubleshooting: If Smart CC draft generation fails, verify Settings → Smart Control Core provider credentials and that /v1/smart-cc/turn returns a successful response. See Policy Builder Code Assist.

Step 4 — Bouncer enforces (~2 min)

Once activated, the Bouncer evaluates the control on every agent request. Unauthorized API calls and out-of-scope tool invocations receive deny or mask outcomes; allowed traffic passes through unchanged relative to your Rego rules.

Verify enforcement: trigger a known-deny scenario and confirm a matching row appears in Audit with outcome deny or mask.

MVP feature flags

Three AI Pilot flags ship default OFF so operators opt in deliberately. Underlying Bouncer and Rego code remains compatible when flags flip on — no binary fork required. Enable flags in Settings → Feature Flags (search for pilot_).

Flag key	What it enables
`pilot_mcp_tool_governance`	Rego enforcement of MCP tool-call intercept via Bouncer intercept — govern which tools an agent identity may invoke.
`pilot_framework_tool_intercept`	Parse agent-framework tool-call headers in Bouncer intercept so LangGraph, LangChain, and similar frameworks are governed without app-side hooks.
`pilot_token_model_cache`	Cache identical model responses at the Bouncer layer to reduce provider token spend on repeat prompts.

Troubleshooting: After enabling a flag, restart affected Bouncers or wait for the next Policy Bridge sync so bouncer_metadata env vars propagate. If behavior does not change, confirm the flag scope includes /pilot and /settings/pilot and check Settings → Feature Flags → effective for your tenant.

Three observability layers

Control Core deliberately separates observability so each store serves one purpose — no duplication of prompt bodies or decision truth across systems.

Layer	Store	Control Plane surface	Purpose
Control Core Audit Trail	Control Plane audit store	Audit, AI Pilot Audit tab	PBAC decisions (allow / deny / mask), Policy Bridge sync events, Control Plane administrative actions
Langfuse	Langfuse (ClickHouse)	AI Pilot Activity → AI Traces (metadata only) + deep-link	AI content traces — tokens, latency, model — without storing prompt bodies in the PAP
Grafana or customer SIEM	Loki / OTLP / Splunk / Datadog	External link (`CC_GRAFANA_URL`) or SIEM outbox	Infrastructure metrics and enterprise-wide correlation; customers may substitute their own SIEM

Use Audit when you need authoritative enforcement evidence. Use Langfuse for LLM observability and cost drill-down. Use Grafana or your SIEM for platform SRE metrics and cross-system alerting.

See AI Pilot — Observability Dimensions for filter parameters and worked queries.

Compliance path (separate)

Runtime agent security controls and AI Pilot governance are distinct from sovereign compliance gap analysis. For CCCP, FINTRAC, OSFI, PIPEDA, and other regulatory pack workflows — gap cache, SSIE cycles, and executive compliance reports — use the dedicated Compliance & Gaps workspace at /compliance in the Control Plane.

Agent security controls may support compliance outcomes (for example audit evidence for FINTRAC suspicious-activity monitoring), but pack selection, gap reports, and certification paths are documented under Shadow Discovery and Regulatory Compliance.

Next steps

Control Core AI Pilot — full AI governance configuration
AI Access Controls — broader AI use cases (RAG, MCP, cost governance)
AI Pilot — Observability Dimensions — filter bar, Token Ledger, and worked queries
PBAC Best Practices — control design patterns for agent identities