In February 2026, we submitted a formal comment to the National Institute of Standards and Technology in response to its Request for Information Regarding Security Considerations for Artificial Intelligence Agents (Docket NIST-2025-0035, 91 FR 698).
The submission makes four arguments.
1. The evidence gap
The biggest security gap is missing evidence: nobody can prove what a deployed agent did.
“The most consequential security gap in deployed AI agent systems today is not prompt injection, model manipulation, or adversarial attacks on the model itself. It is the absence of a verifiable, tamper-evident record of what an agent actually did at runtime.”
In practice, most organizations running agents cannot show an auditor what an agent did, which policies were in effect, or whether those policies were enforced. Observability dashboards record telemetry, which an auditor cannot verify independently.
2. Action-level vs prompt-level risk
The risk shows up when the agent calls a tool, even if the prompt was harmless.
“An agent may receive a well-formed, policy-compliant prompt, generate a reasonable response, and then execute a tool call that deletes production data, transfers funds, or exfiltrates sensitive information. Prompt-level controls do not intercept these actions because the action occurs downstream of the model’s output, at the interface between the agent and its tools.”
3. Bypass-by-architecture
Governance implemented as middleware inside the agent’s runtime can be bypassed by the agent itself, by a compromised dependency, or by anyone with access to the agent’s process.
“The governance mechanism and the entity being governed share the same trust boundary. This is analogous to relying on an application to enforce its own access controls without an external authentication service, a pattern that the security community abandoned decades ago.”
It applies to Microsoft’s Agent Governance Toolkit, to framework-layer approaches, and to any design where governance shares a runtime with the agent.
4. Governance independence
The further governance sits from the agent, the more it can be trusted.
“The degree of architectural separation between the agent and its governance layer is the single most important indicator of governance effectiveness.”
Panopticore is built on that principle: it runs in a separate process and trust boundary, enforces policy deterministically, and produces evidence any third party can verify.
Where it led
The submission put the thesis behind Panopticore on the public record. Two months later, Cloud Wars published “The Missing Layer in Enterprise AI: Governance and Auditability,” which made the same architectural argument.
The full submission is available on our site.
