THE AI AGENT HAS AN IDENTITY. WHO CONTROLS IT?

 AI may decide. Security must still authorize.

For years, cybersecurity was built around a relatively simple question:

Who is trying to enter the system?

A human user had an identity.

That identity had credentials.

Those credentials provided certain rights.

And cybersecurity tried to make sure that the person using them was really who he or she claimed to be.

Then came applications, APIs, automated services and machine identities.

Today, we are entering another stage.

The AI agent.

And this changes considerably the problem we have to solve.

An AI agent is not simply an application waiting for someone to press a button.

It can receive an objective, analyse information, make choices, interact with other applications, use APIs, retrieve documents, communicate with other systems and, increasingly, execute actions.

It does not simply answer.

It acts.

And the moment an artificial intelligence is authorized to act, cybersecurity must ask a new question:

WHO IS THE AGENT?

This may sound strange.

We normally associate identity with people.

But inside a digital infrastructure, an AI agent also needs an identity because an organization must be capable of determining:

Who authorized it?

What resources can it access?

Which information can it read?

Which applications can it communicate with?

What actions may it execute?

For how long does its authorization remain valid?

And, perhaps most importantly:

Who can stop it?

This is no longer a theoretical discussion.

In 2026, NIST has been working specifically on the problem of software and AI-agent identity and authorization, including identification, authorization, auditing, non-repudiation and protection against prompt-injection-related attacks.

OWASP has also identified risks such as agent goal hijacking, tool misuse, identity and privilege abuse, agentic supply-chain vulnerabilities and unexpected code execution among the important security problems facing agentic applications.

Why is this important?

Because an error made by an AI that only writes a sentence is one thing.

An error made by an AI that possesses credentials, tools and access rights is something completely different.

Imagine an agent authorized to access corporate documents.

Then give it access to email.

Then to an API.

Then perhaps to a database.

Then allow it to execute an automated workflow.

Each permission may appear reasonable when considered separately.

Together, however, we may have created something entirely new:

a digital actor capable of moving through several parts of the organization without a human being approving each individual action.

That is where the real cybersecurity question begins.

THE PROBLEM IS NOT ONLY WHETHER THE AI IS INTELLIGENT

The problem is what the intelligence is allowed to do.

We can train an AI.

We can establish rules.

We can place instructions in its system prompt.

We can tell it never to disclose confidential information.

We can tell it not to perform dangerous operations.

All of this is useful.

But none of it should become our final security boundary.

Why?

Because the intelligence itself can be deceived.

A malicious instruction may be hidden inside a document.

A compromised application may return manipulated information.

An API may provide unexpected content.

An attacker may attempt to redirect the objective of the agent.

An agent may misunderstand what it has been asked to accomplish.

Or a perfectly legitimate action may produce an illegitimate consequence when combined with several other actions.

The security architecture must therefore assume something fundamental:

The AI agent can make a mistake.

This is exactly the same reasoning that led cybersecurity to Zero Trust.

Zero Trust does not necessarily mean that we believe everybody is dishonest.

It means that trust alone cannot be the mechanism protecting the infrastructure.

And this principle must now be extended to artificial intelligence.

ZERO TRUST FOR AI

An AI agent should receive only the access necessary to accomplish the task it has been assigned.

Not the access it might possibly need one day.

Not the access that is easier for the developer to configure.

Not unlimited access because the agent is considered intelligent.

Only what is necessary.

If an agent needs to read one category of documents, this does not mean it should be able to read every document.

If it needs one API, this does not mean it should freely communicate with every service.

If it needs to perform one operation, this does not necessarily mean it should possess permanent authority to perform twenty others.

This is the principle of least privilege applied to artificial intelligence.

But I believe we need to go further.

THE INTELLIGENCE SHOULD NOT BE ITS OWN SECURITY AUTHORITY

This distinction is, for me, essential.

We should be able to trust an AI to analyse.

We may allow it to recommend.

We may even permit it to decide within a defined perimeter.

But the infrastructure surrounding that intelligence must remain capable of independently deciding whether the resulting action is permitted.

That means identity control.

Segmentation.

Access control.

Network control.

Monitoring.

Logging.

Anomaly detection.

And the ability to interrupt an unauthorized action independently from the agent itself.

This is particularly important because the danger of tomorrow may not resemble the malware attacks to which we have become accustomed.

Imagine instead:

A legitimate AI.

Using legitimate credentials.

Calling a legitimate application.

Through a legitimate API.

But performing an action that should never have been permitted.

Every component in that chain may appear legitimate.

The result is not.

That is why protecting AI cannot consist only of protecting the AI model.

We must protect the environment in which the intelligence operates.

FROM CYBERSECURITY TO CYBER GOVERNANCE OF ACTION

I believe this represents one of the next major evolutions of cybersecurity.

Yesterday, we protected computers.

Then networks.

Then identities.

Then applications and APIs.

Now we must also control autonomous digital actors.

And this requires a slightly different philosophy.

The objective should not be to prevent artificial intelligence from acting.

That would eliminate much of its value.

The objective should be to create an infrastructure in which intelligence can operate without receiving uncontrolled authority.

This philosophy is also very close to what we have tried to build at PT SYDECO through our security architecture.

Protection should not depend upon one single mechanism.

Different components have different responsibilities.

Traffic can be observed.

Networks can be segmented.

Actions can be controlled.

Abnormal behaviour can be detected.

Sensitive information can be protected.

And an intelligent component should remain surrounded by security mechanisms that are independent from that intelligence.

Not because we are against AI.

Quite the opposite.

Because the more capable AI becomes, the more important its security perimeter becomes.

We are giving software something software has rarely possessed before:

A degree of initiative.

That initiative can create extraordinary productivity.

But initiative without boundaries becomes authority.

And authority without control becomes risk.

Therefore, the cybersecurity question for the age of AI agents should perhaps no longer be only:

“Can we trust this AI?”

There is another question which may ultimately prove more important:

“Even if we trust it, what are we allowing it to do?”

That is where the future architecture of AI security will be built.

AI MAY DECIDE.

SECURITY MUST STILL AUTHORIZE.

Patrick Houyoux, LL.M.
President — PT SYDECO
Yogyakarta, Indonesia

Newsletter 2.2 — August 2026

 

 

WHEN AI STOPS ANSWERING AND STARTS ACTING

Houyoux LL.M. Patrick

President - Founder PT SYDECO Sovereign Cybersecurity & AI | We Stop API Attacks Before They Reach Systems | No Foreign Cloud

August 12, 2026

The New Cybersecurity Problem: Who Controls the AI Agent?

Houyoux LL.M. Patrick

President - Founder PT SYDECO Sovereign Cybersecurity & AI | We Stop API Attacks Before They Reach Systems | No Foreign Cloud

August 12, 2026

Created by Patrick HOUYOUX LL.M. - August 2026

The next cybersecurity challenge is not simply protecting AI. It is controlling what AI is allowed to do.

For years, cybersecurity professionals have been concerned about outsiders.

Attackers trying to penetrate the network. Malware attempting to establish persistence. Stolen credentials. Vulnerable applications. Compromised APIs.

Then came Zero Trust, built around a fundamental principle: trust should never be assumed simply because somebody or something is already inside the perimeter.

Today, another actor is entering our information systems: The AI agent. And unlike the traditional software applications we are accustomed to securing, an AI agent may be able to observe, interpret, decide and act.

That changes the security equation.

An AI assistant that answers a question is one thing.

An AI agent capable of accessing files, consulting databases, communicating with APIs, using tools, sending messages, executing commands or interacting with other systems is something fundamentally different.

From a cybersecurity perspective, we should therefore begin treating the AI agent for what it increasingly is: a non-human insider.

FROM AI THAT ANSWERS TO AI THAT ACTS

Traditional generative AI was relatively easy to conceptualise.

A user submitted information. The model processed it. The model generated an answer.

The security boundary was primarily around the information entering and leaving the model.

Agentic AI changes this architecture.

An agent can potentially receive an objective, determine intermediate steps, select tools, interact with external resources and perform actions intended to accomplish that objective.

NIST now explicitly describes AI agents as systems capable of autonomous actions and has launched work concerning AI-agent identity, authorization and security. In its 2026 analysis, NIST reported broad agreement among respondents that AI agents introduce novel security threats and that established cybersecurity practices, although still relevant, will have to be adapted to address them.

This distinction is essential:

Cybersecurity is no longer concerned only with:

“Can this system be attacked?”

We must also ask:

“What can this system itself do?”

AN EMPLOYEE HAS AN IDENTITY. WHAT ABOUT AN AI AGENT?

Consider how organisations manage human employees.

An employee normally receives an identity.

That identity receives certain permissions.

Those permissions depend upon the employee's function.

Accounting personnel do not necessarily have administrator privileges over cybersecurity infrastructure.

Marketing employees do not automatically receive access to confidential legal documents.

A newly recruited employee should not be able to export an entire customer database simply because that database exists inside the company.

This is ordinary access control.

But now imagine an AI agent operating across several corporate systems.

It can access email.

It can search documents.

It can query a database.

It can interact with an API.

It can generate code.

Perhaps it can execute that code.

Perhaps it can contact another service.

Perhaps it can make decisions without requiring human approval for every individual operation.

What is its identity?

What exactly is it authorised to access?

Which actions can it perform?

For how long?

Under whose authority?

And what happens if the agent is manipulated?

These are no longer theoretical governance questions. They are cybersecurity questions.

THE INSIDER DOES NOT HAVE TO BE MALICIOUS

Calling an AI agent an insider does not mean that the AI itself has malicious intentions.

That would misunderstand the problem.

A human employee does not have to be malicious to create a security incident either.

An employee can open a dangerous attachment.

Send confidential information to the wrong recipient.

Misconfigure a server.

Use an unauthorised cloud application.

Or unknowingly follow instructions provided by an attacker.

An AI agent introduces a comparable problem at machine speed and potentially at machine scale.

OWASP's work on agentic AI identifies risks including goal hijacking, tool misuse, identity and privilege abuse, memory and context poisoning, insecure agent-to-agent communication and rogue-agent behaviour.

One particularly important threat is indirect prompt injection.

An agent may consume information from a website, email, repository, document or another external source. Malicious instructions can be embedded within that information with the objective of influencing the agent's subsequent behaviour.

NIST's agent-security research specifically highlights the possibility of an attacker hijacking an agent through data it processes, potentially causing unintended actions such as disclosure of sensitive information or execution of malicious code.

The attacker may therefore no longer need to compromise the AI model itself.

The attacker may only need to manipulate what the agent sees.

THIS IS WHY “THE AI IS INSIDE OUR NETWORK” IS NOT A SECURITY ARGUMENT

YOUR AI AGENT IS AN INSIDER — TREAT IT LIKE ONE

For decades, organisations implicitly trusted many systems because they were located inside the corporate network.

Cybersecurity learned the danger of that assumption.

Zero Trust emerged partly from the recognition that location is not identity, and internal presence is not proof of legitimacy.

We should not repeat the same mistake with AI.

-        An AI system should not receive unlimited access merely because the organisation owns it.

-        It should not receive unlimited access because it is running locally.

-        It should not receive unlimited access because its purpose is legitimate.

-        And it should not receive unlimited access because somebody authenticated before activating it.

Authentication answers one question:

Who or what are you?

Authorization answers another:

What are you permitted to do?

Agentic AI makes the second question critical.

THE PRINCIPLE SHOULD BE SIMPLE

An AI agent should never receive more freedom than the task requires.

If an agent needs to read five documents, giving it access to five million documents is not convenience.

It is unnecessary exposure.

If an agent needs access to one API endpoint, unrestricted access to every corporate API creates avoidable risk.

If an agent does not need internet access, it should not have internet access.

If an operation involves sensitive data, financial transactions, security configuration, deletion of information or external communication, an organisation should determine whether explicit human approval is required before execution.

And if an agent starts behaving differently from the behaviour expected for its assigned task, the infrastructure must be capable of detecting it.

The objective is not to prevent AI from operating.

The objective is to define its operational boundaries.

ZERO TRUST MUST NOW INCLUDE NON-HUMAN INTELLIGENCE

Zero Trust is frequently summarised as “never trust, always verify.”

Agentic AI gives this principle a new dimension.

Verification cannot occur only when the agent enters the system.

Security increasingly needs to evaluate its operations continuously.

Which resources is the agent requesting?

Which service is it contacting?

What information is leaving the environment?

Is this action necessary for the assigned task?

Is the requested privilege proportionate?

Has its behaviour changed?

Is another agent asking it to perform an operation?

Should the operation require human authorization?

In other words:

- Do not simply authenticate the agent.

- Constrain the agent.

- Observe the agent.

- Segment the agent.

This is where traditional cybersecurity architecture and AI security begin to converge.

SEGMENTATION BECOMES EVEN MORE IMPORTANT

Imagine a compromised employee account in a completely flat network.

The damage can spread because the attacker can move.

Now imagine an AI agent connected to numerous applications, databases and external services under the same philosophy.

The potential attack surface multiplies.

Segmentation provides boundaries.

An agent assigned to one operational environment should not automatically be capable of reaching another.

A system that processes legal documents does not necessarily need access to financial infrastructure.

An education-related AI service does not necessarily need unrestricted communication with administrative systems.

A local analytical engine does not necessarily require permanent external connectivity.

The network architecture should reflect the actual mission of the system.

This is one of the reasons I believe AI security cannot be separated from infrastructure security.

Protecting the model alone is insufficient.

The environment in which the model is authorised to act must also be protected.

DATA SOVEREIGNTY BECOMES AN AI SECURITY QUESTION

There is another consequence.

AI agents consume information.

Often, a great deal of information.

Organisations therefore need to know not only where their data is stored but where an agent can send it.

An organisation can encrypt a database perfectly and still lose information after an authorised process decrypts it for legitimate use.

Encryption remains essential.

But encryption alone cannot answer:

“Should this information be leaving this environment at all?”

Data-loss prevention, controlled communications, local processing where appropriate, network restrictions, strong authorization and monitoring therefore become part of AI governance.

Data sovereignty is no longer simply a question of where a server is geographically located.

It increasingly concerns who — human or machine — can access information, under what authority, and where that information is permitted to travel.

WHAT THIS MEANS FOR SYDECO

At SYDECO, we did not originally develop ARCHANGEL, MiniFW-AI, SydeCloud or SST because somebody predicted today's agentic-AI discussion.

Their origins are cybersecurity.

But the architectural principles behind them are becoming increasingly relevant to this new environment.

ARCHANGEL is based upon layered protection, observation, segmentation and control of communications.

MiniFW-AI is based upon the idea that security restrictions should correspond to the environment and its operational context.

SydeCloud is based upon retaining organisational control over sensitive data and infrastructure.

SST addresses the protection of information through a different approach to cryptography and transmission security.

None of those technologies, individually, constitutes a complete answer to AI-agent security.

Nor should anyone seriously claim that one product can solve such a complex emerging problem.

But the underlying philosophy is becoming increasingly important:

- control the environment,

- limit unnecessary access,

- observe behaviour,

- protect communications and

- never grant more trust than necessary.

THE QUESTION FOR 2026

Organisations are rapidly asking:

“How can we use AI agents?”

That is understandable.

The productivity possibilities are extraordinary.

But cybersecurity professionals must simultaneously ask another question:

“Once we give an AI agent the ability to act, how do we control its authority?”

Because the next major cybersecurity problem may not begin with somebody breaking through the firewall.

It may begin with a perfectly authorised artificial intelligence, operating inside the organisation, being permitted to do something that it should never have been permitted to do.

The AI agent is becoming an insider: It is time we secured it like one.

The Sydeco Security Brief Cybersecurity intelligence, architecture and doctrine from PT SYDECO.