proomt

Search

Search posts, papers, and topics

All posts

Nordic APIsBill Doerrfeld7 min readintermediate

AI Agent Security in the Enterprise: Interview With Isabelle Mauny

Read on nordicapis.com

Summary

Interview with WSO2 Field CTO Isabelle Mauny on how enterprise AI agents and Model‑Control‑Planes (MCP) amplify existing API security flaws, introduce supply‑chain risks, and demand deterministic workflows (e.g., via Arazzo) and centralized governance tools.

  • AI agents inherit and amplify pre‑existing API vulnerabilities (e.g., broken object‑level authorization) because they can issue rapid, unrestricted calls.
  • MCP servers act like third‑party packages, creating supply‑chain attack surfaces such as tool‑poisoning and privilege drift; they need vetting, sandboxing, versioning, and lifecycle management.
  • Deterministic, higher‑level “backend‑for‑agent” APIs (e.g., described with the OpenAPI‑initiative Arazzo spec) reduce nondeterministic reasoning, token waste, and cost overruns.
  • Visibility platforms like WSO2’s Agent Manager are essential for monitoring agent behavior, evaluating model performance, and controlling token consumption.

Enterprises are rapidly deploying AI agents that can bypass or amplify weak API controls, and the emerging MCP ecosystem introduces a new supply‑chain attack vector. Without deterministic workflows and centralized governance, organizations face security breaches, uncontrolled token costs, and opera…

4/10
llmgovernanceapi securityagentic aimcpazazzo

Related reading

  1. Podcast: Securing AI Agents: Identity, Authorization, and the DPACT Framework

    This podcast discusses the critical challenges of identity, authorization, and security for AI agents. It introduces the DPACT framework (Delegation, Policy, Auditability, Context, Time) as a blueprint for building responsible agentic systems with bounded, delegated authority, moving beyond simple token-based access.

    InfoQinfoq.com29 mintalk

  3. Article: Beyond Relevance: A Governance-First Architecture for Enterprise Personalization

    The article proposes a governance‑first architecture for enterprise personalization, where policy‑driven steps (memory, journey graph, AI routing, scoring, trust checks, outcome simulation) shape the recommendation before it is returned. A reference FastAPI implementation demonstrates the pattern with external YAML policies and optional LLM assistance.

    InfoQinfoq.com19 min

  4. AI Skills with Matt Pocock

    Matt Pocock explains how he uses AI agents for software development, emphasizing "strategic programming" and guiding agents with "leading words" from classic engineering texts. He argues that this approach makes engineering fundamentals more critical than ever for creating agent-optimized codebases.

    The Pragmatic Engineerpragmaticengineer.com7 min

  5. Agentic AI: Beyond the Hype

    The article is a marketing overview of CloudBees' agentic AI push, highlighting a webinar, the “Three H’s” governance framework, and the new MCP Server AI integration now on AWS Marketplace. It contains no technical deep‑dive or implementation specifics for engineers.

    Codeshipcloudbees.com2 min

  6. Changing the game: How Google uses agentic AI to secure hundreds of millions of lines of code

    Google’s AI & Infrastructure team built an agentic pipeline (Mantis) that runs pre‑submit AI‑driven scans on every code check‑in, validates findings with a fast triage agent (AST + call‑graph analysis) achieving >92% precision in <1 min, then auto‑generates fixes via a bug‑fix agent. Localized threat models and a two‑step scan cut false‑positives to ~3% and prevent hundreds of vulnerabilities eac…

    Google Cloud Bloggoogle.com4 min