Partner POV | The New Rules of AI Security: A Practical Guide to Governing Generative and Agentic AI

Article written and provided by, Glean. 

AI is changing the enterprise security model. What began as a wave of generative AI assistants has evolved into systems that can retrieve information, make decisions and take actions across tools and applications, often without a person approving every step.

This shift creates new opportunities for productivity and automation, but it also introduces new questions about identity, authorization, data protection, accountability and response. Traditional controls built around human users, predictable workflows and after-the-fact review are not enough on their own.

The answer is not to slow innovation. It is to build governance into the architecture so organizations can deploy AI with greater speed, visibility and confidence.

Executive summary

Enterprise AI is moving from single-turn assistance to agentic execution. AI agents can persist across multiple steps, retrieve data, interact with applications, make decisions and take action. That autonomy is what makes them valuable—and what makes them fundamentally different from traditional software or a basic chat assistant.

The security perimeter is expanding beyond people and devices to include agents, service accounts, plugins, APIs, prompts, model behavior and the data that flows between systems. Agents may be built internally, created by partners, purchased from vendors or introduced informally by employees. Each category introduces different governance and visibility requirements.

The AWARE framework from the Work AI Institute offers a practical way to govern this new environment. Its five dimensions are:

• Actor Intent: Who or what is acting, and why?
• Work Context: Is this data or action sensitive in this context?
• Autonomous Guardrails: Does the action match the agent's declared purpose and policy constraints?
• Real-Time Risk Scoring and Blocking: How risky is the agent's behavior right now?
• Ecosystem Observability: Can the organization trace what the agent did across systems and over time?

AWARE is designed to complement, not replace, existing security investments. It provides a common language for connecting identity, access, data governance, runtime enforcement, monitoring and executive oversight.

AI agents are creating a new attack surface

Enterprise security was largely designed around human users, known devices, structured systems and predictable data flows. AI agents challenge each of those assumptions.

An agent may act on behalf of a person, operate through a service account or move across multiple applications using APIs and plugins. It may retrieve information from one system, analyze it with another and then send a message or update a record somewhere else. A traditional log may show the API call, but not the prompts, instructions, intermediate decisions and context that led to the action.

This creates three immediate questions for security teams:

• Authentication: Can we verify the identity behind the action?
• Authorization: Did the agent have the right access—and was it explicitly authorized to perform this action?
• Auditability: Can we reconstruct what the agent saw, decided and did?

The agent landscape also extends beyond what an organization builds itself. First-party agents, partner-built agents, third-party SaaS agents and employee-introduced "shadow agents" all need to be inventoried and governed. Treating only internally developed agents as part of the security program leaves meaningful gaps in the enterprise attack surface.

Why traditional controls struggle to keep up

AI systems operate at machine speed and can produce outcomes across multiple systems before a human review process has time to intervene. Weekly audits and after-the-fact log analysis remain useful, but they cannot be the primary control for every agent action.

Glean's AWARE whitepaper cites Palo Alto Networks Unit 42 research showing how quickly modern attacks can progress. In 2025, the fastest 25% of intrusions reached exfiltration in 1.2 hours, while Unit 42 simulations of AI-assisted attacks compressed that window to as little as 25 minutes. The whitepaper also reports that 95% of leaders say they are investing in AI, while only 34% say they have built an AI governance framework fully and at scale.

The practical implication is clear: human-in-the-loop review should remain an escalation layer, but it must be paired with automated controls that act at machine speed. Organizations need policies enforced at execution time, dynamic risk scoring that adapts to behavior and automated remediation that can pause or quarantine an unsafe session before damage spreads.

The five dimensions of AWARE

Actor Intent: establish purpose and ownership

Every AI agent should have a declared purpose, clear ownership and a traceable initiation path. An agent created to support IT ticket resolution should not silently become a general-purpose system with access to HR, finance or strategic planning data.

This extends Zero Trust principles to non-human entities. Agents should be treated as first-class identities with scoped permissions, defined owners and lifecycle controls. A registry should record what each agent is designed to do, which systems it can access, which model and plugins it uses and when its configuration last changed.

Work Context: evaluate sensitivity in the moment

Static labels such as "confidential" are not enough for dynamic AI workflows. The same document may be appropriate to summarize for one user but inappropriate to send to an external recipient. Sensitivity depends on who is asking, what they are trying to do, which data is involved and when the action occurs.

Context-aware controls evaluate the action at runtime. They consider the user's role, the agent's purpose, the data's sensitivity, the timing and the surrounding workflow. This helps prevent an agent from using information simply because it can technically access it.

Autonomous Guardrails: constrain behavior before and during execution

Agents can hallucinate, drift or misinterpret instructions. Guardrails should therefore be explicit and enforceable, not merely documented in a policy manual.

A declarative agent configuration can define allowed actions, approved endpoints, accessible data classes, permitted plugins, disallowed prompts, output requirements and escalation paths. Prompt and output filtering can identify suspicious or policy-violating behavior. Guardrails should also validate inputs received from other agents rather than assuming that an upstream output is trustworthy.

Real-Time Risk Scoring and Blocking: respond as behavior changes

Risk is dynamic. An agent performing a routine task may be low risk until it begins making unexpected API calls, accessing unfamiliar repositories or combining sensitive information in a new way.

Risk scoring should adapt to those signals and trigger proportionate action. Depending on the scenario, controls may rate-limit the session, require additional approval, route the action for human review, sandbox the agent or stop execution entirely. The objective is not to block every unusual action; it is to identify meaningful deviations quickly and respond before they become incidents.

Ecosystem Observability: trace the full chain of activity

Agents rarely stay inside one application. They move across messaging platforms, databases, APIs, tickets, dashboards and documents. Security teams need a coherent trail showing what the agent saw, when it saw it, what it did and why.

Observability should include prompts, retrieved content, tool calls, outputs, configuration changes, handoffs and downstream actions. Cross-system traceability supports incident response, forensic analysis, policy refinement, compliance reporting and better understanding of how agents behave in production.

From framework to architecture: five control layers

The AWARE dimensions define what should be governed. The AI security stack defines where those controls should operate across the agent lifecycle.

1. Identity and dynamic authorization

Give every agent a unique, scoped identity with ownership metadata and defined permissions. Avoid shared credentials and broad service accounts. Just-in-time access and rapid key revocation can reduce the blast radius when an agent is compromised or misbehaves.

2. Context-aware access control

Evaluate access based on the user, agent, data, purpose and moment—not just whether a technical permission exists. This helps address stale permissions, accidental oversharing and retrieval of information that is accessible but inappropriate for the task.

3. Declarative agent configuration

Treat an agent's configuration as an operating contract. Define its purpose, scope, tools, data classes, approved plugins, prompt and output policies and error-handling behavior. Integrate guardrail tests and security review into the development and deployment pipeline.

4. Runtime enforcement and remediation

Monitor behavior while the agent is operating. Detect anomalous access patterns, prompt injection, sensitive data spills, unexpected tool sequences and cascading failures. Use automated controls to alert, pause, quarantine or shut down an agent when the risk exceeds an established threshold.

5. Ecosystem governance and observability

Centralize the telemetry, dashboards and traceability needed to answer: What agents are live? Who owns them? What systems are they accessing? How has their behavior changed? Which actions were blocked, escalated or remediated?

No single layer is sufficient. Strong AI security uses defense in depth so that missed detections at one layer can be caught at another. The goal is security by design—and security by default.

The threat patterns leaders should plan for

AWARE applies these controls to the risks most likely to emerge as organizations scale agentic AI:

• Prompt injection and jailbreaking: Malicious instructions can be inserted directly into a prompt or indirectly into a document, message or web page that an agent processes.
• RAG leakage and context misuse: An agent may surface information that is technically accessible but inappropriate for the user, purpose or moment.
• Agent chaining and cascading failures: A small error or manipulated output can move through a sequence of agents and trigger unintended downstream actions.
• Silent drift and scope creep: Configuration changes, new plugins, permission creep or model updates can cause an agent to evolve beyond its approved purpose.
• Embedding leakage and model inversion: Sensitive information can be exposed through embeddings, vector stores or model behavior even when an attacker does not directly access the original files.

These scenarios reinforce why every agent needs declared intent, contextual controls, runtime guardrails, behavioral monitoring and end-to-end observability.

A practical roadmap for security leaders

The opportunity is to make AI governance an operating capability rather than a one-time compliance exercise. Security, IT, data governance, engineering, legal, compliance and business leaders should share ownership of the program.

A practical rollout can begin with five phases:

• Foundation: Inventory internal, partner and third-party agents; assign identities and owners; establish baseline logging and high-risk triggers.
• Data governance: Classify sensitive data, clean up over-broad permissions and apply context-aware access controls.
• Platform engineering: Define agent configuration standards, add guardrail tests to the development pipeline and establish secure release processes.
• Policy and approval: Align acceptable-use policies, human-review thresholds, plugin approvals and regulatory requirements to agent behavior.
• Governance plane: Launch risk dashboards, recurring reviews, scenario testing, automated remediation and cross-functional accountability.

Start with representative workflows and measurable outcomes. Useful metrics include the percentage of agents with an owner and declared purpose, the percentage with real-time monitoring, the number of scope changes that trigger review and the median time required to quarantine a rogue agent in a drill.

This is where a partner-led approach can help. WWT can support the strategy, architecture validation, integration and change-management work required to connect security controls to the systems and processes already in place. Glean provides the enterprise context, permissions-aware foundation and Work AI capabilities needed to help organizations govern and secure AI agents as they retrieve information and act across the enterprise.

Governance is an enabler of responsible AI adoption

The most important message for security and business leaders is that governance should not be treated as a brake on AI adoption. When controls are bolted on after deployment, organizations increase the risk of breaches, rework, public backlash and regulatory intervention. When governance is embedded from the beginning, it can accelerate adoption by giving teams a safer path to experiment, deploy and scale.

The future of enterprise AI will not be secured by one tool or one team. It will require a layered architecture, shared operating language and real-time visibility into how agents behave.

AWARE gives leaders a practical lens for that work: understand who or what is acting, evaluate the context, constrain behavior, respond to risk as it emerges and maintain a complete record across the ecosystem.

Organizations that build those capabilities now can move from reactive defense to resilient design—protecting trust while enabling AI to deliver meaningful value at enterprise scale.