CISO position: Treat an AI agent as a non-human operator with identity, permissions, tools, data access, policy obligations, and an evidence trail.

Why agentic AI changes the security model

Traditional assistants produce text. Agents can retrieve sensitive knowledge, call tools, create outputs, communicate with systems, and participate in operational decisions. That expanded capability changes the impact of a compromised prompt, an excessive permission, or an untrusted data source.

The objective is not to eliminate autonomy. It is to make autonomy bounded, observable, and proportional to risk.

The principal threat surface

Untrusted instructions

Prompt injection can arrive through user input, retrieved documents, web content, tickets, email, or tool output. The platform must distinguish instructions from data and prevent untrusted content from changing system policy.

Excessive agency

An agent with broad tools and weak approval requirements can cause more damage than its business role requires. Permissions should be scoped to the minimum actions and data needed for the task.

Data disclosure

Sensitive information can be exposed through retrieval, model-provider requests, logs, reports, or agent-to-agent communication. Data classification and provider policy must travel with the workflow.

Unsafe tool use

Tool calls turn model output into external action. Inputs require validation, actions require authorization, and consequential operations require human approval or a deterministic policy gate.

Supply-chain and model risk

Models, connectors, libraries, datasets, and external services create dependencies. The organization needs visibility into what is used, why it is approved, and how a change affects risk.

The Chakali control model

Identity → Permission → Policy → Execution → Evidence

Every agent should have a named owner, defined role, approved model route, permitted knowledge scope, authorized abilities, and explicit escalation path.

Before execution

Authenticate the user, service, and agent context.
Classify the use case and requested action.
Confirm the selected model and data route are approved.
Resolve tool permissions and knowledge access.
Apply input and retrieval guardrails.

During execution

Separate policy instructions from untrusted content.
Validate tool parameters and constrain outputs.
Apply rate, cost, and iteration limits.
Require approval at consequential decisions.
Record model, retrieval, tool, policy, and human events.

After execution

Preserve a tamper-evident execution record.
Evaluate quality, safety, and policy outcomes.
Route exceptions and incidents to accountable owners.
Support investigation, replay, and evidence export.

Securing RAG and enterprise knowledge

Retrieval must not become a side door around access control. A secure design carries user and agent identity into retrieval, enforces source permissions before content reaches the model, records provenance, and filters sensitive outputs.

The answer should show its sources. The execution record should show which chunks were retrieved, which policy allowed access, and which model received the context.

Multi-model security

Model choice is a policy decision, not only an engineering decision. Routing should consider data sensitivity, residency, provider terms, model capability, task risk, and deployment location.

For restricted workloads, Chakali can route to approved private or on-premises models. For lower-risk tasks, the organization can use external providers under defined controls. The workflow remains stable while the intelligence layer changes.

Evidence a CISO should request

Agent and service identities
Role and permission assignments
Approved model catalogue
Model-routing decisions
Connected tool inventory
Knowledge-source permissions
Guardrail and policy results
Human approvals and overrides
Complete tool-call history
Evaluation and red-team results
Security exceptions and incidents
Data retention and deletion records

Framework alignment

Security teams can use the OWASP GenAI Security Project to structure application threat testing and the NIST Generative AI Profile to connect technical risk to organizational governance.

Alignment should be demonstrated through a control mapping and evidence. It should not be presented as certification unless an independent assessment has been completed.

Production readiness questions

Can an agent act outside its assigned tools or data scope?
Can retrieved content override system policy?
Is every consequential action attributable to an identity and approval?
Can sensitive workloads be forced to a private model route?
Can security reconstruct an execution without relying on generated prose?
Can the organization disable a model, tool, agent, or workflow quickly?
Are incidents integrated into the existing security operating model?

Secure agentic AI is achieved when the answers are enforced by the platform, visible to operators, and supported by evidence.