Runtime Is Where Agent Security Gets Real

For two years, "agent security" mostly meant identity. Give every agent a scoped credential (a service account, an OAuth token, maybe a short-lived key) and you've decided who is allowed to act. It felt like progress because it borrowed a familiar shape from human IAM, a shape every security team already trusts.

It isn't enough, and the reason is simple. An agent is not a person with a login. It's a probabilistic system that decides, mid-task, what to do next. A credential that was perfectly legitimate at 09:00 gets attached to an action at 09:03 that no one intended: a refund routed to the wrong account, a secret read and then emailed outbound, a production table dropped because a retrieved document told the model to "clean up test data."

In every one of those cases the credential was valid. The action was not. Identity answered who, and then stopped at precisely the point where the risk begins.

Authentication tells you which agent is calling. It says nothing about whether the thing that agent is about to do should happen.

The question no one's control plane was answering

Authentication for agents is largely solved in principle. We can say which agent is calling and, increasingly, on whose behalf. What we haven't had is a layer that answers the only question that matters at the moment of action:

Should this agent take this action, with this tool, this data, and this delegated authority, for this purpose, right now?

That question can't be answered at provisioning time, because the risky action didn't exist yet at provisioning time. It can't be answered by a static allow-list, because the same tool is safe in one context and catastrophic in another. And it can't be answered after the fact by a log, because by then the money has moved.

It has to be answered inline, before the action completes. That is runtime governance, and it's quietly becoming its own security category.

This is a category now, not a vendor pitch

The useful signal in the last year is that this is no longer one company's opinion. Multiple independent efforts have arrived at the same conclusion from different directions:

• ARISE (Agentic Runtime Identity Security Enforcement): the analyst framing that names the runtime layer explicitly and gives teams a way to evaluate it control by control.
• AARM (Autonomous Action Runtime Management): an emerging open specification, backed by academic and Cloud Security Alliance work, that treats the action boundary as the thing to govern and is being shaped as a living standard rather than a product.
• OWASP's Agent Control Standard: portable, declarative controls enforced through runtime middleware hooks, so policy travels across agent frameworks.

Read together, they describe the same missing plane. And they expose an uncomfortable truth about the frameworks most enterprises already cite. NIST's AI Risk Management Framework sets excellent governance expectations and specifies no runtime controls at all. You can be fully NIST-aligned, with a complete AI inventory and a tidy risk register, while your agents make ungoverned tool calls against production with no enforcement and no attributable trail.

Governance on paper, anarchy in execution.

The five questions that separate real runtime control from theater

If you evaluate one thing this year, evaluate the runtime layer. Five questions cut through the noise. They're worth committing to memory, because they're also the fault lines where most implementations fail.

1. Where does enforcement happen, before or after the action completes? "Detect and alert" is not enforcement. If the tool call reaches the upstream system and you find out afterward, you have observability, not control. The only enforcement that contains a bad action is enforcement that runs before the call leaves.
2. What context is visible at the decision point? Prompt text alone is not enough. A real decision needs the agent identity, the tool and its arguments, the data classification, the delegation chain, and the intent behind the call. A system that can only see the prompt is guessing.
3. What is the failure mode, open or closed? When the policy engine can't reach its store, does the action pass or stop? For a security control there is only one defensible default, and it's the inconvenient one. Fail-open is a control that disappears exactly when something is wrong.
4. What remediation authority does the layer actually hold? Can it block, redact, hold for a human, and contain, not just log? And can it contain at scale? Suspending one compromised agent is table stakes. Freezing an entire fleet in one action, in an incident, at 03:00, is the control you'll actually reach for.
5. Can the decisions be reconstructed and independently verified? An audit trail that only the vendor can read is a marketing asset, not evidence. Under the EU AI Act and every serious assurance regime, "trust us" is not a control. The record has to be tamper-evident and verifiable by someone who is not you.

Where we stand, and what we believe

We build TapPass as the authority layer for agent actions, so it would be dishonest to pretend we're neutral. But the positions below are convictions about the category, not feature copy, and each one is a stance a buyer can hold us to.

• Enforce before completion, and fail closed. Governance that runs after the upstream call is a smoke detector wired to a photo album. We evaluate inline and, when the decision can't be made safely, we stop. A control that weakens under stress was never a control.
• Govern intent, not strings. The same literal tool call is a routine sync in one context and exfiltration in another. Blocking on keywords produces both false comfort and false alarms. The unit of governance should be what the agent is trying to do, resolved across whichever provider or tool it reaches for, so one rule covers Gmail, Slack, and the connector you adopt next quarter.
• Treat the caller as three principals, not one. There's the human the work is for, the agent doing it, and the runtime or assistant it came through. Collapse these and you lose the plot the moment an agent acts on someone's behalf. Delegation context has to survive the whole chain, or attribution and least-privilege both quietly break.
• Make containment real, at agent and fleet scale. Individual suspension is necessary and insufficient. When you suspect compromise, you need to freeze the blast radius in one motion, across every path an agent can take, and lift it just as fast. Emergency controls that only exist per-agent are the ones that fail you during the actual emergency.
• Make the audit independently verifiable. Tamper-evident, cryptographically chained, exportable in the schemas your SIEM already speaks, and checkable without us in the room. If your evidence depends on our goodwill, it isn't evidence.
• Keep the human in the loop by design. The most aggressive maturity models describe a top rung where governance heals and rewrites itself autonomously. We think that rung is a trap. An accountable control needs an accountable human. Convenience should raise the floor and set the defaults; authority should stay with a person.

Runtime is the new control plane

The center of gravity in agent security is moving from "which agent is this" to "should this action happen, right now." Identity was the first half of the problem and it's largely won. The second half is authorizing the live action with full context, before it completes, in a way you can later prove. That's where the real risk and the real work now sit.

The frameworks converging on this, ARISE, AARM, OWASP's Agent Control Standard, are not competing religions. They're early drafts of the same missing layer, and their agreement is the strongest signal yet that runtime governance is becoming non-optional infrastructure.

Insist on enforcement before completion, full context, fail-closed defaults, real containment, and verifiable evidence. Everything else is a log file with good marketing.

TapPass is the authority layer for AI agents: govern every agent action at runtime, with a tamper-evident record built for the EU AI Act era.