The model can request an action. The authorization system decides.
Prompt injection is not a bug you patch in the prompt. It is the reason agent actions must be authorized outside the model.
Read moreResearch
Positions with reasoning
Original analysis of how machine identities, credentials, access and AI agents fail — and the models that make them governable. Every position shows its working.
All research
Latest research
2 papers, newest first.
Why non-human identity risk has to be explainable
A conceptual framework for scoring machine-identity risk that a human can audit — and why a score without evidence is worse than no score.
Read moreStart here
The fundamentals the research builds on
Primers and reference pages that define the vocabulary, the relationship model and the frameworks the research papers assume.
- NHI Security 101Definitions, taxonomy, the relationship model and the ten risks that matterLearn more
- AI Agent Security 101Why agents differ, the threat vocabulary and the authorization principleLearn more
- OWASP NHI Top 10Every category mapped to a question, evidence and a controlLearn more
- OWASP Agentic ThreatsAgentic AI threats mapped to identity-centric controlsLearn more
- Security ArchitectureHow the platform itself is built, isolated and auditedLearn more
- GlossaryForty-plus terms, defined plainly and cross-linkedLearn more