Securing enterprise AI agents: where the controls live, and where authority begins — June 2026

Executive tear-sheet

The industry now agrees on how to secure an enterprise AI agent — and that agreement stops one layer short of authority. Reporting on publicly available guidance, not security or compliance advice: guidance on securing enterprise AI agents converges on engineered controls — give the agent its own identity, scope its tools to least privilege, require human approval for consequential actions, and make everything it did auditable. This brief relays that guidance and, separately and clearly labelled, shows where it ends and where authority begins: a securely-built agent can still take an action nobody was authorised to take. It is not security advice.

Key findings

• The control recommendations are right — and they are engineered, not prompted. Distinct agent identity, scoped capability/tool access, human approval for consequential actions, and end-to-end auditability are the recurring four (IBM + Anthropic guidance, 2026).
• Securing the agent is necessary, not sufficient. Least privilege limits what an agent can reach; it does not establish who delegated the authority for a specific action, on what scope, under which policy version — the legitimacy question.
• Audit logs record events; authority requires replayable evidence. An observability trail shows what happened; it does not, by itself, prove the action was admissible and reconstruct the decision from public keys.
• For higher-risk systems this is already a duty. The EU AI Act™ places logging and human-oversight obligations on the deployer at the point of use — runtime, not retrospective.

What the guidance recommends, as reported

TL;DR According to published guidance on securing enterprise AI agents, the agent lifecycle should carry engineered controls: an agent has its own identity (not a borrowed human credential); its tools and scopes are least-privilege; consequential actions route through human approval; and its activity is observable end-to-end.

According to published guidance on securing enterprise AI agents, the agent lifecycle should carry engineered controls: an agent has its own identity (not a borrowed human credential); its tools and scopes are least-privilege; consequential actions route through human approval; and its activity is observable end-to-end. This brief relays that guidance; it does not endorse a specific product and does not characterise the guidance beyond what the cited source states.

What KYE Protocol™ reads into it (interpretation, not advice)

TL;DR This section is KYE Protocol™'s interpretation, clearly separated from the reported guidance above, and is not security or compliance advice.

This section is KYE Protocol™'s interpretation, clearly separated from the reported guidance above, and is not security or compliance advice. Each recommended control has an authority counterpart that KYE Protocol™ supplies above the security layer — KYE Protocol™ governs agents as first-class principals; it does not run them:

• Agent identity → the agent is a first-class principal in the authority chain, so an action resolves to who delegated to whom, not just which key signed.
• Least-privilege tools → scoped capability is checked at the action boundary as <a href="/knowledge-graph.html">Action Admissibility™</a>, and a delegated agent's actual calls are reconciled against its declared scope.
• Human approval → governed approval modes (single / two-person / legal-gated / auto), each emitting an evidence event — oversight you can show, not assert.
• Auditability → the sealed <a href="/evidence-pack.html">Evidence Pack™</a> + <a href="/authority-sourcing.html">Authority Sourcing™</a> make the action Replay-Proof™: reconstructable and verifiable from published keys alone, not just logged.

The boundary KYE Protocol™ states plainly: a perfectly secured agent — own identity, least privilege, sandboxed — can still execute an action no one had the authority to authorise. Security asks can this agent reach the tool?; authority asks was this agent allowed to take this action, and can we prove it? Whether and how any of this applies to a given organisation is a matter for that organisation's own advisers.