Capabilities
Every control, and the problem it exists to solve
Each capability maps to a defined agent-specific problem. Nothing here is generic enterprise security scope — if a control does not strengthen agent authority, enforcement or evidence, it does not belong on this list.
Family 01
Identity & Registry
Know every agent, who owns it, and what authority it actually holds.
Agent Discovery
Discovery is the entry point because enterprises cannot govern agents they do not know exist. The engine should combine API enumeration, cloud metadata, identity/service-account analysis, source-code/config scanning and observed runtime traffic to identify both sanctioned and shadow agents.
LANDING FEATURE →
Agent Registry
The registry is the system of record for agent identity, ownership, purpose, risk and lifecycle. It should feel like a purpose-built CMDB for autonomous software, but with dynamic fields for models, tools, delegation, policies and business intent.
SYSTEM OF RECORD →
Agent Identity
Agents need first-class identity rather than borrowed human credentials. NIST’s 2026 concept work on software and AI-agent identity highlights identification, authorization, auditing and non-repudiation as emerging needs. Agent Trust Cloud should represent agent identity, the party it acts for, and the scope of delegated authority.
IDENTITY RULE →
Authentication & Attestation
Authentication proves which agent or workload is making a request. Attestation strengthens that proof by checking properties of the workload or deployment. The product should support multiple enterprise authentication patterns because agent environments vary widely.
SECURITY POSTURE →
Agent Lifecycle Management
Agents should have controlled birth, change and retirement processes just like employees and service accounts. Lifecycle automation prevents dormant agents, obsolete permissions and orphaned credentials from accumulating as organizations rapidly experiment with AI.
LIFECYCLE PRINCIPLE →
Family 03
Runtime Enforcement
Intercept the action itself: allow, deny, redact, sandbox, approve or stop.
Runtime Agent Gateway
The runtime gateway turns Agent Trust Cloud from a dashboard into control infrastructure. It intercepts or brokers sensitive agent actions, enriches them with identity and risk context, evaluates policy, optionally requests approval, then forwards or blocks the action.
ENFORCEMENT PATH →
Agent Firewall
The Agent Firewall is the policy enforcement product experience layered on the gateway. It should make autonomous actions governable using understandable rules, not force customers to reason about low-level proxy configuration.
PRODUCT MOMENT →
Human-in-the-Loop Approvals
Human approval is the bridge between autonomous speed and accountable high-impact actions. The workflow should provide the approver enough context to make a decision quickly without forcing them to open several systems.
UX RULE →
Sandboxing & Execution Boundaries
Some agent tasks require executing code, browsing the web or handling untrusted files. These workloads need isolation because policy alone cannot guarantee that arbitrary code or content behaves safely.
ISOLATION PRINCIPLE →
Family 04
AI-Native Security
Defend the parts of the stack that only exist because the actor is a model.
Prompt-Injection Defense
Prompt injection is dangerous when untrusted content can influence an agent that has tools or authority. The defense should not rely on a single classifier. Use layered controls that reduce the consequences of manipulated instructions even when detection is imperfect.
OWASP ALIGNMENT →
Data-Loss Prevention
DLP for agents must operate at the point where data crosses tool, model and destination boundaries. It should understand which agent is moving what data, to which destination, under whose authority and for what business purpose.
KEY QUESTION →
Context, Memory & Retrieval Security
Agent memory and retrieval systems can become hidden persistence layers for sensitive data, malicious instructions and stale authority assumptions. Agent Trust Cloud should make memory stores and retrieval sources visible and governable.
RISK →
Model & Provider Governance
Enterprises will use multiple models and providers. Agent Trust Cloud should normalize policy across them while giving customers control over which models may process which data and perform which types of work.
VENDOR NEUTRALITY →
Family 05
Agent Surfaces
Protect the specific places agents gain capability and take business action.
MCP Security
Model Context Protocol and similar tool protocols can dramatically increase agent capability by making tools discoverable and invokable. Agent Trust Cloud should act as a secure MCP gateway/registry that verifies servers, constrains tools and records every invocation.
STRATEGIC FEATURE →
Coding Agent Security
Coding agents can read proprietary code, modify repositories, install dependencies, access CI/CD secrets and trigger deployments. Secure them as privileged engineering identities rather than treating them like autocomplete tools.
POSITIONING →
Browser & Computer-Use Agent Security
Browser/computer-use agents are especially risky because they interact with arbitrary interfaces that may not expose clean APIs. Controls must combine isolated sessions, destination restrictions, action classification and approval of sensitive UI operations.
RISK →
SaaS & ERP Agent Security
Enterprise value depends on controlling agents where business actions happen: Microsoft 365, Google Workspace, Salesforce, ServiceNow, SAP, Oracle, Workday and financial systems. Build reusable action models instead of isolated point integrations.
VALUE →