The agentic-security market is converging on a story. Over the past several months, two product categories have emerged as the foundation of how the industry thinks about AI agent governance: workload identity management for non-human actors, and behavioral observability over agent runtime. The vendors landing acquisitions and analyst attention in this space — Astrix-class workload identity platforms, Galileo-class AI observability platforms — are real capabilities, well-chosen, and they cover more of the problem than anything that came before them. They are not the wrong foundation. They are the right one, and the timing is good.
The interesting question is not about the pieces. It is about the architecture those pieces are being assembled into. The narrative forming around the category — three pillars, identity plus observability plus runtime protection, lifecycle from credential to evaluation — is a natural thing for an industry to settle on when its first major acquisitions land. The story has to be told with what is in hand.
But the narrative is load-bearing in a different way for the market than it is for any one company’s quarterly announcement. If “identity plus observability plus runtime protection” becomes the definition of agentic security, the industry spends the next several years filling in those three buckets and calling the problem solved. That is not a mistake anyone is making today. It is a trajectory the market is starting down, and it is worth naming before it hardens.
What these categories make possible is bigger than the story currently being told about them. They are not the three pillars of a complete stack. They are the first two layers of a pipeline that has three more layers above them — and those remaining layers are where the paradigm shift actually lives.
The Monolithic PDP Assumption
Every access control paradigm of the past four decades — RBAC, ABAC, PBAC, ReBAC, XACML — shares one architectural shape. A Policy Enforcement Point intercepts a request. A Policy Decision Point evaluates it against a policy model. The PDP returns allow or deny. The PEP executes the verdict.
The model has evolved. Roles became attributes. Attributes became relationships. Each generation added vocabulary. None of them changed the shape. One request. One decision. One engine. One authoritative seat of policy.
The shape works because the classical subject — a human user, a static service — has a small, stable set of properties that fit plausibly inside one model. Adding richer attributes extends the PDP’s vocabulary without changing the architecture. Every paradigm shift inside the xBAC family has been a vocabulary extension.
Autonomous agents break the shape itself. They are not a richer subject. They are simultaneously evaluable across five different domains that refuse to fit in one policy language.
The Five Competence Domains
To govern an autonomous agent, you need to answer five questions at once:
- Identity. Who spawned this agent, from what lineage, under what credential, with whose sponsorship?
- Behavior. What has it done, is its output coherent, is it drifting from baseline?
- Intent. What did it declare it would do, and is it staying inside that scope contract?
- Trust. How is its standing evolving — under stress, over time, across generations?
- Context. Given the HR, DLP, legal, regulatory, and situational signals that apply right now, should this action be happening here at all?
These are not five attributes of a unified subject. They are five competence domains. Each requires different reasoning. Each consumes different sensor sources. Each has a different rate of change. Each produces a different kind of enforcement primitive.
Identity reasoning cannot be expressed as intent reasoning. Trust reasoning cannot be expressed as context reasoning. The attempt to cram all five into a single policy language produces an unmaintainable Frankenstein that no reviewer can audit and no regulator can accept.
The attempt to keep the monolithic PDP and extend its vocabulary to cover agents is how the industry arrives at the reduction I started with: “agentic governance” becomes “identity governance for agents,” because identity is the one competence domain the legacy PDP vocabulary already knows how to encode.
Layered Cooperative Enforcement
The alternative is to stop trying. Each competence domain gets its own enforcer. Requests flow through a pipeline. Each layer enforces from its own competence, consumes upstream sensor data, emits new signal downstream, and can veto, modulate, or annotate the outcome. No single layer owns the decision. The governed outcome is emergent — the composition of what every layer allowed, reshaped, and signaled.
I call this layered cooperative enforcement. It is not a better PDP. It is a different architectural shape.
Two properties make this shift load-bearing.
First, sensor data becomes a first-class output of enforcement. In xBAC, sensor data is input the PDP consumes to reach a verdict. In cooperative enforcement, sensor data is also produced at every step. Each enforcement is simultaneously a sensing event. The audit artifact is no longer a decision log. It is a trajectory chain accumulating signal as the request traverses the pipeline. Visibility stops being a bolted-on observability product. It becomes a by-product of enforcement itself.
Second, extensibility becomes additive. xBAC absorbs new requirements by extending the policy model inside the PDP. Every new attribute interacts with every existing policy rule — a quadratic cost curve that eventually makes the model unmaintainable. Cooperative enforcement absorbs new requirements by adding a layer. When a sixth competence domain becomes necessary — energy governance for autonomous infrastructure, economic accountability between agents, something not yet named — it slots in without rewriting any existing layer. New layers absorb new complexity; old layers stay bounded.
These two properties are what make the architecture future-proof. Without them, every agentic-security product ships as a patch to an architecture that is structurally unable to hold what’s coming.
How Tamed Autonomy Supplies the Missing Layers
Tamed Autonomy — the research program I’ve been publishing under — is not a monolithic product. It is a set of primitives that together complete the pipeline.
- Intent declarations are structured purpose statements that agents sign before acting. They bind the agent to a scope contract — resources, action classes, time bounds, data classifications, amendment rules. Every subsequent action is evaluated against the contract. An agent that declares narrow intent and deviates gets caught by scope enforcement. An agent that tries to declare broad intent faces normative constraints before the contract binds. There is no path to ungoverned operation through deceptive declaration. The intent layer answers “is this action inside the scope this agent signed for?”
- Trust physics — drawn from the Kinetic Trust Protocol — treat trust as a computed, dynamic value. Trust accumulates slowly, collapses fast on deviation, weights experience earned under stress more heavily than experience accumulated in calm, imposes progressive friction as an agent accumulates access, and ties child agents’ starting trust to sponsors who stake their own. The trust layer answers “given history, lineage, and pressure, what is this agent’s standing right now?”
- Normative constraints encode the organizational context that credentials and behavior cannot see — HR status, data classification, litigation holds, trading blackouts, clinical urgency, regulatory jurisdiction. These become machine-enforceable predicates evaluated over a typed context object. The normative layer answers “should this action be happening, here, now, given everything going on around it?”
- Trajectory chains are dual-signed, append-only records of what an agent declared and what it actually did. They are the substrate every layer annotates. They make forensic attribution possible — distinguishing a misbehaving agent from a legitimately-operating agent acting on poisoned tool output — and they are the shared sensor fabric the pipeline cooperates through.
- Provenance chains extend the trajectory idea backward to agent creation itself. Who spawned this agent? Under whose sponsorship? With what delegation? Provenance and trajectory together create a complete, cryptographically attributable life history that downstream layers can reason over.
These are not patches to identity. They are the three layers above identity and behavior that the cooperative enforcement pipeline needs to actually cooperate.
What the Current Industry Narrative Captures — and What It Leaves for Next
Come back to the three-pillar framing from the top of this piece.
Industry analyst coverage of the workload-identity-for-agents category does an excellent job explaining why workload identity management and identity-visibility platforms are emerging as categories in their own right. Real-time monitoring against expected baselines, automatic revocation on anomaly, just-in-time credential management — these are real capabilities, well-chosen, and the products being assembled in this space deliver them at meaningful scale. Layer 1 (identity) and Layer 2 (behavior) are getting covered.
The lifecycle framings being published around recent acquisitions — identity, observability, runtime protection, all stitched into a lifecycle view — make coherent cases for how the current generation of products fits together end to end. The lifecycle language is genuinely useful.
The natural shape of those framings is determined by what has just been acquired and what is in hand. That is how it should be. You cannot write the story of a portfolio around capabilities you do not yet own. And the foundations these stories rest on are the right foundations — identity governance and behavioral observability are exactly what the first two layers of an agentic security architecture need to do well.
What the current framings leave room for — and what the five-layer view surfaces — is the three layers above them.
- Intent shows up in current framings as a property inside a behavioral evaluator. That is a reasonable place for it to live today. As a declarative layer of its own — a signed scope contract that an agent binds to before it acts — intent becomes much more powerful than a behavioral property can be.
- Trust appears in current framings as the rhetorical line “trust must be engineered into the full lifecycle.” The sentiment is right. What is waiting to be built is a trust primitive with actual physics — velocity, stress-weighted history, lineage caps — rather than trust as a lifecycle attribute.
- Normative reasoning — whether an authorized, baseline-consistent action is appropriate given the organizational context right now — is not part of either framing yet. That is the layer with the most ground to cover and the highest ceiling.
These are not gaps in what has been delivered. They are the next moves. Workload identity fills the identity slot. Behavioral observability fills the behavior slot. Three slots above them — intent, trust, context — are where the agentic security market is heading, and they are the layers that turn a strong two-layer foundation into a five-layer platform.
What Each Missing Layer Catches That the Filled Ones Cannot
Three scenarios make the gap concrete.
An employee in a notice period deploys a personal productivity agent to summarize R&D material they used to have access to. The credentials are valid. The agent is registered. Its behavior is indistinguishable from how similar agents operated last quarter. Identity governance approves. Behavioral evaluation approves. A normative layer fires a hard veto because HR_status = notice_period AND data_classification = trade_secret. No other layer could see the signal.
An oncology agent needs to escalate a critical drug interaction to an on-call physician, but the escalation path falls narrowly outside its declared scope. Pure scope enforcement blocks it — correct behavior under the rule. A normative layer detects clinical_urgency = critical AND external_database_confirmed = true, reclassifies the action risk downward, permits the escalation under mandatory human review within fifteen minutes, and logs the override. Rigid policy would have killed the patient. Emergent policy saved them.
Three individually innocent agents — one analyzing internal transaction records, one compressing report data, one emailing summaries to stakeholders — pass governance individually. Composed together, their declared intents reconstruct a data exfiltration chain. No single-agent evaluation would catch it. Composite intent evaluation at the intent + normative layers does. And the sponsorship-bond economics of the trust layer make a 300-agent swarm prohibitively expensive to spawn in the first place.
None of these are detectable by a better identity platform. None of them are caught by semantic behavioral evaluation alone. They require layers the market has not yet filled.
Why This Architecture Makes Any Enterprise More Solid
The classical security stack was built on a principle: consolidate decision authority in one place, make that place the bottleneck, and make sure nothing gets past it. That principle scaled as long as the things being governed had properties that fit inside one model.
Autonomous agents do not fit. Their governability depends on properties that are structurally incommensurable — you cannot express trust velocity as an ABAC attribute, you cannot encode clinical urgency as a role, you cannot represent sponsorship lineage as a relationship. The consolidation principle that made classical security scale is precisely what breaks under autonomous agent load.
Layered cooperative enforcement inverts the principle without giving up rigor. Authority is distributed. Each layer is narrow enough to be audited, reviewed, and reasoned about independently. Cooperation happens through a shared sensor fabric rather than a shared policy language. Future requirements slot in as new layers instead of breaking existing ones. The architecture becomes easier to extend, easier to audit, and easier to regulate — which is where governance actually has to land by the end of the decade.
The opportunity in front of any enterprise assembling agentic-security capabilities today is the architectural framing: describing what is being put together not as a three-pillar completion but as the first two layers of a five-layer pipeline that the research community is writing specs for right now. That reframing changes what a portfolio is. It is the difference between “we have the best identity governance for agents” and “we own the agentic-security architecture that everyone else will have to interoperate with.” The first is a product category. The second is a platform.
Every enterprise that deploys agents will face the same question over the next few years: is the architecture you are building five layers, or is it two layers with three features bolted on? The former absorbs new governance requirements as additional layers. The latter eventually runs into a requirement that will not fit, and the bolting starts to buckle.
The Next Few Steps of a Larger Shift
The reason to name the five-layer view now — while the two-layer foundation is fresh — is that the trajectory of the next few years is already visible.
Identity governance will continue to tighten. Behavioral observability will continue to improve. Auto-revocation will get faster. Compliance frameworks will converge on workload identity management as the baseline control. All of that is good, and all of it will happen whether the three-pillar framing becomes canonical or the five-layer framing does.
What differs between the two framings is what happens next.
Under the three-pillar view, the next few years are spent deepening each pillar — more scopes, better anomaly detection, faster revocation loops. Each improvement is real. None of them adds a new competence domain. When the first incident lands that is not detectable by identity or behavioral evaluation — an authorized agent exfiltrating trade secrets during a notice period, a rigidly scoped medical agent failing to escalate a critical alert, a swarm of individually innocuous agents reconstructing a composite exploit — the architecture has no slot for the layer that would have caught it. The post-incident work becomes bolt-on: adding context evaluation, adding intent contracts, adding trust dynamics as patches to a platform that was not designed to hold them.
Under the five-layer view, the same few years are spent the same way on Layers 1 and 2 — because those layers genuinely need the work — and the architecture has named slots for the three layers above them. Intent declarations, trust physics, and normative constraints become roadmap items rather than post-incident additions. When the first incident lands, the infrastructure to handle it already has a place to live.
Both paths lead to the same endpoint eventually. The question is whether the industry gets there by design, over the next few steps of a clearly named paradigm shift, or by reaction, after the incident that forces the naming.
The acquisitions and product launches happening right now in this space are the foundation of the first path. They are excellent ones. The choice ahead is about the story that gets told over them — whether the market treats workload identity and behavioral observability as the completion of agentic security, or as the first two moves of a larger architectural shift that still has three layers to go.
The Bottom Line
The xBAC family had a forty-year run, and it earned it. The monolithic PDP was the right architecture for the subjects it was designed to govern, and the industry has built enormous value on top of that foundation.
Agentic security is building a similar foundation right now. Workload identity management for non-human actors. Behavioral observability over agent runtime. Federated identity and discovery layered underneath. Distributed enforcement infrastructure stitched across the network. Runtime protection at the model edge. These are the identity and behavior layers of the next architecture, and they are being done well.
The shift worth naming — while the foundation is still fresh enough to build on intentionally — is that the next architecture is not a better PDP. It is a pipeline of specialized enforcers: identity, behavior, intent, trust, context. Each reasons from its own competence, cooperates through a shared sensor fabric, and composes into an emergent governance outcome. The identity and behavior layers are landing now. Intent declarations, trust physics, and normative constraints are the next three, and the research community is writing specs for them now.
The recent acquisitions and product launches in this space are an excellent start. They are also, if the architectural framing is right, the first two steps of a larger paradigm shift rather than the completion of it. The companies that treat them as the first two steps will be the ones who own the architecture the rest of the market interoperates with.
Zero Trust said don’t trust the network. Tamed Autonomy says: the next paradigm is not a better decision engine — it is a pipeline of cooperating ones, and the first two layers are already on the table.
Leave a Reply