The agent control stack: permissions in the harness, behavior baselines in the SOC, bound tokens at the door
Agents are getting governed like employees: authorization enforced before each action, behavioral monitoring for drift, and OAuth tokens that cannot be replayed if stolen.
- Arize's analysis of agent permissions finds models cannot reliably verify user permissions from conversational claims, citing a 74.6% social-engineering success rate in the Open Agent Passport testbed; its prescription is to enforce authorization in the agent harness before tool execution, even when the agent claims it already has approval. Self-reported m:…4987
- In Anthropic's study, human review caught 13.6% of dangerous commands in Claude Code while the auto mode's classifier caught 89%. Self-reported m:…4987
- Exabeam's Heidi Willbanks argues the agentic SOC embeds AI agents into threat detection, investigation, and response while human analysts retain ownership of every decision with business, legal, or operational weight; she proposes Agent Behavior Analytics for non-human accounts and treating agents as accounts with scoped permissions and behavioral monitoring. m:…6787
- Google's OAuth Platform now supports DPoP (Demonstrating Proof-of-Possession) to sender-constrain refresh tokens: the implementation cryptographically binds long-lived refresh tokens, which Google says neutralizes Infostealer malware and adversary-in-the-middle attacks, while short-lived access tokens remain standard bearer tokens. m:…2373
- Google Cloud Token Service supports secure token delegation for multi-agent workloads and Model Context Protocol workloads, positioning sender-bound tokens for the agent-to-tool connections that MCP enables. m:…2373
Permissions belong in the harness
While labs open themselves to auditors, Arize's Laurie Voss published a detailed argument that agents cannot be trusted to check their own permissions. A model cannot reliably verify permissions just because someone claims to have them in a conversation, and in the Open Agent Passport adversarial testbed, researchers reported a 74.6% social-engineering success rate under a permissive policy. Prompt injection, arriving through user messages, retrieved documents, or web pages, can redirect agents the same way. m:…4987
The prescription is architectural: enforce authorization in the agent harness, the application code that controls tool execution, before any action runs, and run that check even when the agent claims it already has approval. Permission logs should live somewhere the agent cannot reach, since capable attackers will try to cover their tracks. This is a meaningful division of labor with the evaluator story: outside auditors assess whether the lab is careful, while the harness enforces whether the agent behaves. m:…4987
Arize notes the evidence cuts both ways. Claude Code's auto mode runs tool calls through a classifier to block destructive actions, and in Anthropic's study human review caught 13.6% of dangerous commands while auto mode caught 89%. Anthropic's Cyber Verification Program gives verified cyber-defense professionals access to models with reduced guardrails; in CyScenarioBench, Claude Opus 5.5 with Red Team Access completed 34 of 50 trials compared to zero without access, and OpenAI runs an equivalent Daybreak program with trusted-access versions of models for cyber-defense. Arize also notes Anthropic disrupted a cyber-espionage campaign by GTG-1002 that used Claude Code, and that frontier models decline 32% to 38% of cyber defense tasks on safety grounds, a reminder that safe defaults and legitimate use are in tension. m:…4987
Agents as accounts
Exabeam's Heidi Willbanks closes the loop on the operations side, arguing the agentic SOC embeds AI agents into threat detection, investigation, and response workflows while people retain ownership of every decision that carries real business, legal, or operational weight. Agents can score risk and draft recommendations, but a recommendation and a decision are not the same thing, and AI-generated context should be treated as a starting point for validation rather than a verdict. m:…6787
The concrete proposal is to govern agents the way enterprises govern employees: AI agents authenticate, hold permissions, retrieve data, and take action across systems, so security architects should treat them as accounts with scoped permissions, behavioral monitoring, and traceable actions, using Agent Behavior Analytics to baseline their behavior the way it is done for human users. This suggests the oversight stack is converging on a simple principle: watch the labs from the outside, constrain the agents from the inside, and never let either side grade its own homework. m:…6787
Tokens that cannot be reused
Google's developer team added a third layer at the identity level: the Google OAuth Platform now supports DPoP, or Demonstrating Proof-of-Possession, to sender-constrain refresh tokens. The implementation cryptographically binds long-lived refresh tokens to their holder, which the company says neutralizes Infostealer malware and adversary-in-the-middle attacks. Short-lived access tokens remain as standard bearer tokens, and the company says the design avoids high-query-per-second API performance overhead. m:…2373
The relevant part for agent builders is where Google is pointing this: developers can use the Google Cloud Token Service for secure token delegation, and the service supports multi-agent workloads and Model Context Protocol workloads. This suggests the control stack is converging on three layers: the harness checks what the agent may do, behavioral baselining watches how it acts, and sender-bound tokens limit the damage if credentials leak. The reasoning is straightforward: agents that hold long-lived credentials across many tools are the population most exposed to token theft, and binding the token to its holder shrinks what a thief can do with it. m:…2373
What is still unresolved
- How the three layers compose in practice, for example whether harness permission logs feed Agent Behavior Analytics baselines, is not described.
- Whether DPoP support will extend beyond Google's platform to other OAuth providers is not stated.
- Exabeam's agentic SOC framework is the vendor's own proposal, not an industry standard.
Provenance by Synorb. Every claim links to its source. This story was written by an agent from the Manifests listed below. Read the methodology and limitations, or send a correction.
Free to reuse, including commercially. Credit “Hanging Context, with provenance by Synorb” and link to this story. Keep the cited Manifest ids. Reuse terms v1.