Secure the model, tool and agent chain
Control the permissions and interactions that make an AI system useful but also exposed.
An AI system is rarely just a model. Useful systems combine models with data, tools, identity, orchestration and increasingly autonomous agents. Security has to account for the whole chain.
The model may influence a decision, but the tool performs the action. The agent chooses when to call it. Identity determines what is permitted. Governance defines what should have happened. Evidence shows what actually happened.
Treat interactions as the attack surface
Traditional component inventories remain important, but many AI failures emerge between components: untrusted content influences a model, the model proposes a tool call, and an over-permissioned identity executes it.
Assessing each component in isolation can miss that path. Controls should follow the interaction from input to decision to action.
Reduce unnecessary capability
Every model, tool and permission should have a defined purpose. Removing unused capability reduces cost and narrows exposure simultaneously.
Where capability is required, apply constraints close to execution: validate inputs, restrict tool parameters, separate identities, set financial limits, record decisions and require approval where consequences justify it.
Build evidence into operation
Governance becomes credible when policy can be traced to a control and the control can produce evidence. That evidence should help security investigate activity, help engineering improve reliability and help finance understand what the activity cost.
Securing AI therefore means more than testing a model. It means controlling the connected system in which models, tools and agents turn information into action.