Lasse Andresen

Seems like everyone's promising to secure AI agents. CISOs are still asking for the controls those promises imply. At some point, you have to call bulls**t. A recent Lightspeed survey asked 200 CISOs what they wished AI security vendors would solve. Roughly three in ten responses focused on agent identities, permissions, access and behaviour. Around a quarter focused on sensitive data leakage. These are fundamental requirements: control over what agents do, boundaries that hold, and accountability when something goes wrong. An agent can be carrying out a legitimate task and still expose sensitive information or exceed its authority. When agents act through other agents, the consequences can spread. Every authorization decision must consider the task intent, the authority under which the agent acts, and the live context—enforcing what it may do, with which data and under what conditions. Those limits must hold throughout execution, including when another agent enters the workflow. I’m tired of incumbent vendors putting an agentic label on the same technology underneath - and platforms adding a few permissions and calling it agent control. CISOs need enforceable agent authority and decision traceability: what was permitted, on whose authority, in which context, and why. I’m bullish on what becomes possible when enterprises have that control. Agents can take on complex, consequential work at extraordinary scale. Strong boundaries give the confidence to let them. That’s our mission. And we have it in production. indykite.ai/platform

We are giving AI agents broad access and calling it control. I spent much of my career in identity and access management helping organizations control who could access what. With agents, we have to confront the limits of that question. An agent can operate entirely within your permissions and still do something you never asked for. Ask it to prepare a customer briefing. Your permissions might also let it export the customer database, update records or change contract terms. All permitted. None requested. Delegating your authority leaves the agent to interpret how much of it the task requires. That is a control gap. The intent of the request needs to become part of the access decision, alongside context about the data, relationships and trust involved. And it needs to remain enforceable as work passes across tools and other agents. That is the idea behind intent-based access control. Before we give agents more autonomy, we need a better answer to “was this actually part of the task?” We’ll show what that looks like in Beyond Delegation: Intent-Based Access Control for AI Agents, with a live demo. Hope you can join us! watch.getcontrast.io/registe…

Traditional apps follow pre-set execution paths. Agentic AI builds its own path dynamically as it runs. Governing decisions you cannot map in advance is a completely new challenge for enterprise security. Here is why Zero Trust must evolve for AI indykite.ai/download-center/…