Methods, evaluations and reports.

Enterprises are mistaking detailed agent logs for an audit trail. A log proves an action happened. A regulator asks whether the control operated, and you cannot reconstruct an authorisation decision that was never made. The audit record is a byproduct of authorising each action.

The security industry spent a decade adopting Zero Trust, then quietly granted AI agents the exact implicit trust it dismantled. Agents violate every Zero Trust principle. Closing the gap means extending verification to the layer Zero Trust never had to reach: the individual action.

The security industry has spent two years trying to solve prompt injection at the model layer, where the defender cannot win. Prompt injection is not a model problem. It is an authorisation problem, and authorisation problems are solved at the authorisation layer.

Permission boundaries are not an optional hardening step for agentic systems. They are the foundational primitive that makes agents safe to deploy. This piece defines what a real boundary is, why the naive approaches fail, and how enforcement has to work to be meaningful.

OAuth was designed for delegated access between deterministic applications. AI agents are not deterministic. This piece breaks down the six specific places where OAuth fails for AI agents and what a proper authorisation layer requires.

AI agents are being deployed across enterprise systems without the one infrastructure layer they need most: an authorisation layer. This piece defines the pattern, explains why existing approaches fail, and lays out what production-grade AI agent governance actually looks like.