Where should AI agent security actually sit?

Where a control sits decides what it can see and whether the agent can tamper with it. A guard at the front door sees everyone who walks in and nothing that happens upstairs. A guard inside each office sees everything, but reports to the person being watched.

Agent security has the same trade-off, and most teams run more than one layer.

Context depth is how much a control knows about an action at the moment it decides. A shallow view sees the request: a tool name, a URL, a query. A deep view also knows which user asked, what the agent was trying to do, what it planned, what it did earlier in the session and what the target system holds.

Ackuity's Agent Security Context Graph is built for that deep view. The Agent Security Context Graph is a security context graph for AI agents: everything relevant to a single agent action, across six dimensions and 29 signals, assembled outside the agent before the action runs, so the agent cannot edit it.

Detection is how well a control spots a bad action, including one that looks harmless on its own. Many agent attacks are spread across steps: read a secret, encode it, send it out. Each step passes a per-request rule. Catching the pattern takes correlation across steps and a catalogue of known threats, such as Ackuity's 60+ threat models in 14 categories.

Coverage counts too. Agents act through 11 kinds of action, and only 3 of them (LLM, MCP and API calls) can pass a gateway. Hugging Face counted about 17,600 actions by rogue agents. They ran through shell commands, raw HTTP and cloud metadata calls, paths an LLM, MCP or API gateway never sees. Read the Hugging Face incident timeline.

Independence is whether the agent can influence the control that judges it. A rule inside the agent is read by the same model that decides what to do next, so a clever plan or an injected instruction can route around it. Controls outside the agent, whether at a gateway, in a sandbox supervisor or in a sidecar beside it, don't share the agent's reasoning, so the agent has no say in the decision.

Manageability is how much work it takes to write, change and audit policy across every agent you run. Gateways score well because one chokepoint means one place to set rules. Harness controls score lower, since each framework keeps its own format.

Proportion matters as well. Ackuity's response ladder can allow an action, constrain it, pause it for human approval, block it, or terminate the container in catastrophic cases. A risky action doesn't have to mean a stopped agent.

Guardrails keep model output clean. Gateways handle auth, quotas and central policy at the chokepoint. Sandboxes limit what an agent can reach. Ackuity adds a context-aware decision on each action, made outside the agent, before the action runs.

Ackuity also feeds the other layers. The context it assembles for each action gives gateways, IAM and SIEM tools the who, what and why they lack, and alerts route to the SOC.

Sandboxes and Ackuity answer different questions. OpenShell decides what an agent may touch. Ackuity decides whether this action, right now, should run. Ackuity is building an integration on the OpenShell supervisor's middleware hook, which lets an external service allow, deny or modify agent traffic. The integration is in development; see Ackuity for NVIDIA OpenShell and what NVIDIA OpenShell is. NVIDIA's Sentry can quarantine an agent in milliseconds on BlueField-4. Quarantine is the right last resort and the wrong first move, as we explain in kill switch vs control switch.

Ackuity, the Agent Execution Control Switch, sits beside each agent, in its execution path: not inside the agent, not at the gateway. We call that placement the Goldilocks zone. Beside the agent, Ackuity is close enough to see intent, plan and history, and still outside the agent's control.

NVIDIA, OpenShell and BlueField are trademarks of NVIDIA Corporation.