# AI agent security: draw the boundary before the action Nexus Lens · AI-assisted editorial explainer By NexusTechWire · Original context prepared October 3, 2026; sources rechecked October 15, 2026 Canonical: https://nexustechwire.com/lenses/agent-security An agent that can open an app, call a service or change a file needs more than a well-written request. The useful question is what it can reach, what it can change, and where a person can intervene. Give each task a small, explicit permission boundary. Enforce it in the tools and environment, then make consequential actions visible and reviewable. ## Follow the permission boundary Conceptual workflow, not live telemetry or a guarantee of safety. 1. **Known task.** Separate the user's request from outside content. 2. **Permission check.** Check the caller, resource and allowed action. 3. **Limited tools.** Constrain data access, changes and network reach. 4. **Reviewable action.** Record the outcome and provide a way to stop. ## A login is the beginning of the boundary. Authentication identifies a caller; authorization decides what that caller may do. The MCP authorization guide describes checking access tokens and permissions for protected resources. For a reader, the practical distinction is simple: connecting an account should not silently grant every action that account can perform. Ask: Can this agent read a document, edit it, or share it? Make those separate decisions. Basis: [Model Context Protocol](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/authorization); [Model Context Protocol](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices). ## Give the task less room to go wrong. AISI describes adding independent network restrictions around its cyber evaluation environments, alongside monitoring and revised evaluation design. The transferable lesson is to enforce limits outside the model as well as in its instructions. For an ordinary workflow, that can mean a specific folder, a read-only connection, or a short list of permitted destinations. Ask: If the agent takes an unexpected step, what can the environment actually prevent? Basis: [AI Security Institute](https://www.aisi.gov.uk/blog/building-a-more-secure-environment-for-evaluating-dangerous-capabilities). ## Keep the task attached to the permission. MCP's security guidance calls for clear consent and narrow scopes, and rejects passing through tokens meant for other services. Those are concrete boundaries, not just reassuring interface text. Our practical recommendation: treat retrieved pages and tool output as data, and ask again when an action would expand the user's agreed task. Ask: Does the next action still serve the request the person approved? Basis: [Model Context Protocol](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices). ## Make it possible to notice—and stop. AISI pairs restrictions with action monitoring and human escalation, while acknowledging that monitoring has limits. For everyday agents, our recommendation is a review step before consequential changes, an understandable action record, and a working stop or revoke control. Test those controls as the tools and permissions change. Ask: Could someone tell what happened, interrupt it, and remove further access? Basis: [AI Security Institute](https://www.aisi.gov.uk/blog/building-a-more-secure-environment-for-evaluating-dangerous-capabilities). ## Dated primary-source context AISI's engineering update describes stronger controls for its frontier AI evaluations. It combines outbound-network restrictions, monitoring and changes to evaluation design, and says the work remains ongoing. [AI Security Institute: original report](https://www.aisi.gov.uk/blog/building-a-more-secure-environment-for-evaluating-dangerous-capabilities) Transluce's September 30 report examines apparent agent activity from May and June, including failed attempts against government websites. The authors say they found no instances in the examined datasets where agents accessed information that was not public. [Transluce: original report](https://transluce.org/us-canada-gov) These separate reports inform the practical recommendations here. This Lens is source-based editorial explanation, not a NexusTechWire investigation or a finding about the products below. ## Sources & reading - [Building a more secure environment for evaluating dangerous capabilities](https://www.aisi.gov.uk/blog/building-a-more-secure-environment-for-evaluating-dangerous-capabilities) — AI Security Institute. Engineering update · publication date not stated on current page. - [AI Agents Targeted U.S. and Canadian Government Websites](https://transluce.org/us-canada-gov) — Transluce. Research report · September 30, 2026 · earlier May–June activity. - [Understanding Authorization in MCP](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/authorization) — Model Context Protocol. Official documentation · version 2026-07-28. - [Security Best Practices](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices) — Model Context Protocol. Official documentation · version 2026-07-28. This original explainer is prepared for review. Preparation and source-check dates do not represent a public release. The dated reports are context, not a claim of a new incident today. [Editorial policy](https://nexustechwire.com/editorial-policy)