Security1 publisher2 min readPublished
meshIQ's Gourab Basu puts the agent control boundary inside the execution path
His case rests on a refund workflow where anything over $100 needs human confirmation, a rule that stays an instruction while it lives in the prompt and becomes enforceable only when something inspects the tool call first.
The Watch · Security desk
What happened
- Gourab Basu, Global Head of Engineering at meshIQ, told Help Net Security that a prompt cannot be an agent's control boundary, because the agent can change its own execution path as it works.
- His example is a refund workflow where a governance layer inspects the proposed tool call and its parameters, passing refunds below the threshold and pausing anything above $100 until a human confirms it.
- Asked what breaks first when a company goes from ten agents to a thousand, he said the loss is confidence that changes to enterprise systems of record are being governed consistently.
- He argues that controls designed around human users and traditional applications are not sufficient on their own once an agent is deciding dynamically which action to take next.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision Where the check sits becomes a design choice with a security owner. A control at the system of record sees a completed write; one in the agent path can still refuse the call.
- constraint Pre-execution approval only holds if policy separates what proceeds automatically from what needs a person, because a fleet that size can generate more pause events than a review queue absorbs.
- exposure The exposed surface is enterprise systems of record, and the population of agents able to change them outgrows the manual oversight that covered ten of them.
- capability A framework-independent engine lets one policy survive a change of agent framework, so the business can swap runtimes without the security team rebuilding its gate.
The prompt is the one layer an agent is free to reinterpret. "Assuming an agent will always follow an instruction in a prompt is the modern equivalent of trusting a partner system to always send perfectly formed XML," Basu said [5]. Give the agent a goal and it decides which tools to call, in what order, and how to adjust as the workflow runs [3]. Timing is what separates his gate from a log: "The important distinction is timing: the policy is enforced while the action can still be stopped, rather than discovering afterward that an agent issued a refund outside the approved threshold," Basu said [8].
The frame he takes from integration work is older than agents. "One lesson integration engineers learned a long time ago is that orchestration and control cannot be the same thing," Basu said [4]. The refund workflow is offered as a hypothetical, and the interview does not report a deployment where such a control stopped a live agent [16].
The scaling scenario in the interview is a company going from ten agents to a thousand in a year [10], a hundredfold increase over twelve months [15]. At ten, Basu said, teams may still understand which agents have access to which systems and compensate with manual oversight; at a thousand, the number of agents capable of changing enterprise records grows dramatically, and more capable models can widen the scope of the actions those agents attempt [10].
Controls at the destination were built for human users and traditional applications, which is why Basu treats them as insufficient on their own once the caller is making dynamic decisions [11]. A gate also has to sort what proceeds from what stops. Otherwise, in his words, "manual review either becomes a bottleneck or gets bypassed" [13].
For teams that will end up running more than one framework, the architecture he describes is a set of loosely coupled layers with a framework-independent governance engine at the center [14]. He limits the claim about what that buys: "That does not make a nondeterministic agent deterministic. It creates predictable boundaries around nondeterministic execution," Basu said [12].
What to watch
- Whether any vendor publishes measured figures for in-flow interception: added latency, false stops, and how often a gate actually blocks an out-of-policy tool call.
- Whether the major agent frameworks expose a pre-execution hook a third-party gate can attach to without patching the runtime.
- A disclosed incident in which an agent wrote to a system of record outside its stated policy, which would move this argument from hypothetical to case file.