AI Security Fabric and Reference Architecture

Phillip Messerschmidt

Description

Short Summary

Interesting Facts

Notable Quotes

Recommendations

Takeaways

Description

Autonomous agents based on AI now act inside enterprise systems with their own credentials, their own tools, and, increasingly, their own judgment. Most organizations cannot yet say which agents exist, who owns them, what they are allowed to do, or how to stop them. The KuppingerCole AI Security Fabric and the KuppingerCole AI Security Reference Architecture provide one coherent blueprint to answer these questions. The Fabric shows who acts, how control is delivered through capabilities, services, and tools, and what is accessed or done. The Reference Architecture describes 68 capabilities in five functional groups, AIdentity, AI Governance, AI Safety, AI Protection, and AI Transparency, in detail. This Advisory Note introduces both frameworks and explains how each capability is described, so that organizations can use them to design, assess, and evolve their AI security architecture and to select tools last.

Short Summary

AI agents have shifted from experimental prototypes to operational actors faster than organizations have built controls to govern them. These agents read documents, call tools, connect to Model Context Protocol (MCP) servers, write and run code, and delegate work to other agents—often at machine speed and under credentials never designed for autonomous decision-makers. Existing disciplines (IAM, cybersecurity, governance) cover fragments, but they do not fully answer the core accountability questions demanded by boards, auditors, and regulators: what an agent did, under whose authority, and whether it could have been stopped. Regulatory regimes such as the EU AI Act, DORA, and GDPR raise the stakes by requiring oversight, record keeping, and accountability.

The KuppingerCole AI Security Fabric provides a stable structure to organize this space: identities answer who is acting, capabilities/services/tools deliver how control is implemented, and resources/actions/data define what is accessed or done. It explicitly recommends defining needed capabilities first, bundling them into services second, and choosing tools last to avoid vendor-category confusion.

The AI Security Reference Architecture operationalizes the Fabric as a tool-neutral model of 68 capabilities grouped into AIdentity, AI Governance, AI Safety, AI Protection, and AI Transparency, arranged across Core, Extended, Integrations, and Privileged layers, supported by an API layer and a shared Foundation (including a registry data model and policy-as-code). Key findings include treating autonomy as the primary risk driver (not identity type), rejecting “monitoring-only” approaches in favor of real-time constraints and stoppability, and making ownership and registry records the prerequisite for authorization, attribution, review, and retirement.

Interesting Facts

The AI Security Reference Architecture contains 68 capabilities organized into five functional groups.
AIdentity includes 14 capabilities.
AI Governance includes 14 capabilities.
AI Safety includes 13 capabilities.
AI Protection includes 14 capabilities.
AI Transparency includes 13 capabilities.
The capabilities are arranged into four layers: Core, Extended, Integrations, and Privileged.
The Core layer contains 28 capabilities.
The Extended layer contains 25 capabilities.
The Integrations layer contains eight capabilities, and the Privileged layer contains seven capabilities.

Notable Quotes

“AI agents have moved from experiment to operation faster than the controls around them.”
“Customers define the capabilities they need first, bundle them into services that match their organization, and select tools last.”
“Autonomy rather than identity type determines how much risk an agent carries.”
“Monitoring alone is not control.”
“Ownership is the precondition for everything else.”
“Written policies do not stop an agent.”
“Every agent must remain stoppable.”
“Human oversight cannot be the primary control at machine speed.”
“Detection of attacks on models, data, and agents can never be complete.”
“Organizations that can state who an agent is, who owns it, what it is allowed to do, how it can be stopped, and what it did will be governing their agents.”

Recommendations

Define required capabilities first, bundle them into organizational services second, and select tools last to avoid category-driven gaps.
Run continuous discovery across SaaS, agent platforms, cloud environments, code repositories, and endpoints to surface shadow AI.
Enforce registration as a hard gate by blocking provisioning for any agent lacking a registry record, owner, and provisioning record.
Assign five accountable roles per agent: business owner, risk owner, technical owner, incident contact, and intervention authority.
Replace periodic governance with event-driven reviews triggered by scope, owner, model, or version changes and by owner departures.
Eliminate static secrets by issuing short-lived scoped credentials, using attestable workload identity, and vaulting/rotating unavoidable secrets.
Authorize consequential actions continuously and close to the resource with default-deny, using current context signals rather than session-start decisions.
Implement executable rule enforcement at tool and MCP calls, and build a kill switch that reaches tokens, derived grants, sub-agents, and queued actions.
Reduce blast radius by combining injection detection with least privilege, trust-zone containment, and credential isolation.
Instrument agents end-to-end with open telemetry formats, mandate-based attribution, tamper-evident records, SIEM streaming, and post-retirement evidence retention.

Become a member of the KuppingerCole Community to access this and thousands of other publications.

Takeaways

Capability coverage across identity, governance, safety, protection, and transparency matters more than buying a single “agent security” product.
Autonomy level is the dominant driver of risk and should determine how strict controls must be.
Ownership and registry discipline are prerequisites for meaningful authorization, attribution, review, and retirement.
Real-time enforcement and stoppability are required; monitoring alone cannot control agents acting at machine speed.
Audit-ready transparency depends on telemetry with decision context, tamper-evident recordkeeping, and retained evidence.

Become a member of the KuppingerCole Community to access this and thousands of other publications.