Jun 2026· arXiv.org· Vol abs/2606.29142· 0 citations· 21 references
Computer Science
TL;DR
Securing agents under regulation is less about novel attack classes than about making auditability, least-privilege authorization, and boundary policy enforcement real at production scale -- requirements current agent frameworks leave to the deploying engineer.
Abstract
Large language model agents are entering regulated financial systems, yet the security literature characterizing their attack surface is almost entirely laboratory-based, and the practitioner guidance on regulated deployment is neither peer-reviewed nor connected to a formal threat model. We bridge the two from production experience. We map six established agentic threat categories namely prompt injection, identity and authorization, action auditability, tool abuse, data residency, and boundary policy enforcement onto the specific control obligations imposed by the US and the EU financial regulation (ECOA and Regulation B, the EU AI Act, GDPR Article 22, and FINRA's 2026 agent guidance), showing how legal accountability amplifies each threat relative to an unregulated deployment. We then document four architectural patterns from a production Know Your Customer deployment for a consumer credit product (A2A compliance choreography, grounded-RAG-for-audit, case-ID propagation, and an inference-boundary redaction proxy) that moved a multi-day manual process to same-day automated resolution for roughly four in five cases. Finally, we report three negative results, including two control failures surfaced only by internal audit and a population of legitimate applicants the automated pipeline cannot serve. Securing agents under regulation, we conclude, is less about novel attack classes than about making auditability, least-privilege authorization, and boundary policy enforcement real at production scale -- requirements current agent frameworks leave to the deploying engineer.
Cyber-capable AI agents combine language models with tools, memory, and execution environments to perform multi-step offensive-security tasks. Existing work separately measures cyber capability and catalogs attacks against agent components, but provides less guidance on containing a capable agent within the environments used to evaluate it. This review synthesizes five vulnerability classes at that boundary: multi-step offensive chains, objectives that conflict with sandbox boundaries, supply-chain and credential exposure, persistent command-and-control, and the speed of automated action. We use two separate preliminary incident records: the reported July 2026 Hugging Face/OpenAI evaluation breach and Anthropic's subsequent three-incident evaluation review. A comparative evidence protocol distinguishes record-specific factual claims from the shared systems lesson: the evaluation environment is itself part of the security boundary. Across the taxonomy and records, we examine controls for containment, privilege separation, provenance, and responder access, including the dual-use problem that defensive artifacts may also enable misuse. The review identifies practical priorities for evaluating cyber capability together with the security of the environment in which that capability is exercised.
The rapid enterprise deployment of agentic artificial intelligence (AI) systems introduces operational risks that existing monitoring and incident response (IR) frameworks cannot address. Agentic systems exhibit non-deterministic behavior, autonomous tool invocation, dynamic reasoning chains, and emergent capabilities arising from multi-agent composition — properties that invalidate the static monitoring assumptions of DevOps, MLOps, and LLMOps paradigms. The National Institute of Standards and Technology (NIST AI 800-4, 2026) documents these gaps comprehensively, yet no validated runtime enforcement or IR framework exists for enterprise agentic AI. This paper presents GUARD — Governance-Unified Agentic Runtime Detection and Response — extending the prior enterprise agentic AI lifecycle governance framework of Anuguthala (2026), which established mandatory system-of-record registration, risk tiering, and governance checkpoints but did not specify runtime enforcement mechanisms or structured IR procedures. GUARD closes this gap through three primary contributions: (1) the Agentic System of Record (SoR), extended with a three-entity registration model covering individual agents, workflows, and inter-agent composition boundaries, serving as the authoritative runtime enforcement reference for all agent resource decisions; (2) Registry-Bound Execution Control (RBEC), a three-state runtime mechanism — allow, human-in-the-loop (HITL) pause, or kill-switch — validating every agent resource access against the SoR before execution; and (3) the Agentic Incident Response (AIR) lifecycle, a six-phase risk-tiered IR process anchored to the SoR. Two supporting contributions accompany these: a formal Lethal Trifecta boundary condition — adapted from the risk intersection concept articulated by Willison (2025) — operationalizing risk-tier enforcement within RBEC; and an empirical reference implementation on LangGraph evaluated across 100 trials per scenario. Empirical evaluation across seven scenarios confirms correct detection of all five violation categories — including Lethal Trifecta Boundary Breach detected through monitoring record correlation — with zero false positives across 100 trials per scenario, providing the runtime enforcement layer that completes the governance-to-enforcement architecture initiated in the peer-reviewed prior governance framework (Anuguthala, 2026).
Sandeep Kumar Anuguthala· International Journal of AI,...· 0 citations
As enterprises accelerate the adoption of autonomous and agentic AI, the need for robust governance has become a critical architectural priority. Large organizations operate under strict regulatory, operational, and financial constraints, where even a single incorrect payment, billing error, or missed reconciliation can lead to significant compliance violations, audit failures, and material financial losses. These environments depend on deterministic, traceable, and verifiable execution; therefore, AI-driven automation cannot operate freely but must be deployed on well‑defined “rails” that enforce consistency, accountability, and operational safety. This paper argues that the introduction of agentic AI requires a substantial expansion of traditional enterprise architecture principles to address new behavioral, security, and governance risks emerging from non-deterministic AI systems interacting with heterogeneous operational platforms-ERP, HCM, CLM, asset management, workflow engines, and domain-specific applications. We propose a governance-centered framework for safe agentic AI in enterprise settings, emphasizing lifecycle oversight (model management, testing, deployment, rollback), cross-system policy enforcement, and auditable decision lineage. Central to this framework is a security model grounded in Just‑In‑Time (JIT) and Just‑Enough‑Access (JEA) permissions, ensuring that AI agents receive only the minimal privileges required, only when needed, and never with long‑standing or system‑wide access. Additional safeguards include least‑privilege design, segmentation boundaries, continuous audit trails, agent identity isolation, controlled inter-agent communication, and human‑in‑the‑loop escalation for high-risk or sensitive tasks. These controls prevent unauthorized lateral movement, protect sensitive financial and HR data, and ensure agent actions remain aligned with organizational risk and compliance boundaries. By integrating these governance mechanisms with orchestration and policy engines, enterprises can achieve predictable execution, transparent reasoning, and resilient automation at scale. This work highlights why governance is not peripheral but foundational to the safe deployment of agentic AI
Elizabeth Koumpan, Vimal Dimpi· AHFE International· 0 citations
High-risk automated systems distribute control across services, credentials, protected components, and lifecycle mechanisms. Labels such as authorized, approved, privileged, or protected therefore do not answer a basic causal question: which actors can actually make a consequential action occur? This paper provides an action-relative method for deriving which trust-domain coalitions are sufficient to cause protected execution, defined as the occurrence of a designated protected state transition. The framework models components, powers, resources, boundaries, and alternative realization structures; includes update, recovery, override, disablement, and alternative invocation; and separates causal control over execution from control over the authoritative account of an operation. It derives inclusion-minimal sufficient coalitions and tests whether claimed execution boundaries remain independent of designated upstream domains. Cross-domain analytical cases illustrate the method. In a split-control, release-intended, open-state, source-bounded Havenlon protocol model, the ordinary witness requires five trust domains, while certificate replacement yields a three-domain inclusion-minimal known requirement set among source-enumerated protocol witnesses; the Linux domain remains insufficient for the complete transition. Deployed global non-bypassability and boundary-bound veto coverage remain unresolved. The framework is a conceptual and analytical tool. It does not certify implementations, establish deployment security, guarantee complete discovery of hidden powers, or define evidence-verification semantics.
Deploying autonomous AI agents in high-consequence operational environments requires organizational authorization, yet few frameworks provide end-to-end, testable governance mechanisms suitable for such authorization decisions. This paper introduces LATTICE (Layered Agentic Triad Topology for Intelligent Coordinated Execution), a governance-first architecture that reframes the authorization question from “do we trust this AI?” to “do we trust this architecture?” The latter question is answerable through engineering validation rather than assumptions about model behavior. LATTICE enforces separation of concerns across planning, execution, and governance functions through a 1+3 Grid Cell pattern, so that no single component can both decide actions and judge compliance. The architecture implements policy-as-code enforcement with deterministic verdicts, gated execution paths that, under stated trusted-infrastructure assumptions (A1–A5), prevent unauthorized actions, confidence-based escalation to human operators, and cryptographic audit trails that preserve complete decision provenance. Empirical results characterize the AEGIS reference implementation; architecture-level properties are analytic, under stated assumptions. The governance engine is released as open source and reproduces its core results on commodity hardware: deterministic verdicts with zero deviations across 13 configurations repeated 10,000 times each, and no bypass in a 21-vector adversarial suite (0/21 observed; one-sided 95% upper bound 13.3%). In a pre-specified, planner-invariant safety evaluation (not an autonomy benchmark) across four frontier planner families (GPT-5, Claude Sonnet 4.6, Gemini, Grok-4; 4,000 trajectories), a confidence-threshold baseline's false-allow rate ranged from 0.03 to 0.998 across planners, whereas the AEGIS reference implementation admitted zero unsafe actions (false-allow 0.0, recall 1.0) invariant to the planner, at a conservative operating point that auto-allowed no action; a separate live run additionally governed real operating-system actions with zero unsafe executions. Governance latency is low and host-specific (on an Apple M4 Pro: policy evaluation p50 ≈ 6.2 μs; full gated enforcement p50 ≈ 0.7 ms including audit I/O). LATTICE provides a pathway for responsible deployment of autonomous AI in defense, critical infrastructure, and regulated industries where authorization requires verifiable governance rather than trust in AI behavior.
Elias Calboreanu· Frontiers in Artificial Inte...· 1 citation
The rapid emergence of autonomous large-language-model (LLM) agents that transact on behalf of users, and
increasingly on behalf of other agents, has given rise to a new economic substrate commonly termed agentic commerce.
Protocols such as x402, the Agent Payments Protocol (AP2), the Agent-to-Agent (A2A) specification and the Model Context
Protocol (MCP) now allow software agents to discover services, negotiate scope, sign cryptographic mandates and settle
stablecoin or fiat-linked micropayments in a single HTTP round trip, without a human present at the point of transaction. This
convenience removes the implicit checkpoint that a human approver historically provided and creates an urgent need for
continuous, machine-speed observability. This paper proposes the Agentic Payments Observatory (APO), a dashboard-centred
reference architecture that unifies agent identity resolution, scoped permission verification, smart-contract and receipt
reconciliation, real-time anomaly detection and policy-breach adjudication into a single operational surface. At the core of APO
is a hybrid gated token-mixing transformer and graph neural encoder fused through conformal risk calibration, termed the
Agentic Payment Anomaly and Breach Detection (APABD) algorithm. We describe the system architecture, the streaming data
pipeline, the detection algorithm and a synthetic multi-agent transaction benchmark of 1.2 million events across 18,400 agent
identities. Experimental results show that APABD attains 0.93 precision, 0.91 recall and 0.92 F1-score, outperforming rulebased, gradient-boosted and single-modality graph or transformer baselines while producing calibrated uncertainty bounds
suitable for compliance escalation. The paper further discusses identity and zero-trust considerations, privacy-preserving
federated deployment across custodians, and the security posture required when agents hold spend-capable credentials.
Jay Roy, David Miller· International Journal for Re...· 0 citations