AI agents entering production need their own identities, limited permissions and a tested way to stop them, says analyst Jonathan Care. His practical checklist is more useful than another promise that a guardrail will make everything safe.
Watch Desk analysis
What happened
In an interview with Help Net Security, Care, KuppingerCole Analysts’ lead analyst and AI practice lead, argues that the AI security category most likely to last is runtime authorisation: deciding what an agent may do at the moment it acts, with context about whom it is acting for.
Before an agent touches production systems, Care recommends five controls: give each agent its own identity and owner; use least-privilege, short-lived credentials; require human approval for irreversible or high-impact actions; log what the agent was asked, decided and did; and test a working kill switch. Familiar security disciplines, in other words, now need to keep pace with software that can act for itself.
Care also expects standalone model scanning, AI security posture management and prompt-injection filtering to be absorbed into larger platforms or model-provider guardrails. He sees stronger prospects for runtime authorisation, identity threat detection for non-human accounts, and security operations tools that demonstrably reduce analyst workload.
Why it matters
The distinction is between spotting a possible problem and controlling what an agent is actually allowed to do. If an agent can change access rights, move money or push code, an alert after the fact is a rather late form of comfort.
Care’s advice gives organisations something concrete to check before deployment: separate identities, narrowly scoped access, human sign-off for consequential actions, usable logs and a kill switch someone has actually tested. His market predictions are an analyst’s view, not a settled forecast, but the operational checklist stands on its own.
Our read
The strongest part of Care’s argument is its focus on permissions and accountability, not on finding a magical filter for every bad prompt. Companies can start by treating each agent as a distinct identity and checking whether its access expires, its actions can be audited and it can be stopped. That is less glamorous than a new security category, which may be precisely why it is useful.
What to watch
- Whether organisations adopt separate identities and short-lived credentials for agents.
- Whether security products make runtime permissions and tested shutdown controls easier to manage.
- Whether the categories Care expects to consolidate do so inside larger security platforms.
Discussion spark: Should organisations be allowed to put AI agents into production without a separate identity, short-lived permissions and a tested kill switch?
Sources and evidence
- Source update (27 October 2026, 06:30 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.