Autonomous agents are here. Security and compliance have to meet them at the door

For two years, most companies met AI as a chat window: a person asks, the model answers, the person decides what to do. That is changing quickly. The major AI platforms now offer always-on agents that keep working toward a goal after the conversation ends, connect to thousands of business applications, and come back to a person only when they decide they need one. At the same time, companies are putting their own agents into production, wired into their ERP, their CRM and their payment systems.

An agent that acts on its own is a different kind of software, and it asks different questions of a security team and of a compliance team.

What changes for security

Authority without a person in the loop. An agent acts with the credentials it was given, at any hour, and most of its actions are never looked at by anyone. The question is no longer whether a person will approve a mistake. It is what the agent can reach before anyone notices.

Instructions arrive inside content. An agent reads documents, emails, web pages and the answers of other tools. Any of them can carry instructions written by someone else, and the agent may follow them as if they came from you. This is prompt injection, and it does not need anyone to break in. It only needs the agent to read something.

Speed and scale. A person who makes a mistake makes it once. An agent can repeat it hundreds of times in a few minutes, or spread it to the other agents it works with.

Agents run in places you do not control. An always-on agent from an AI platform runs on that vendor's computers. You cannot install anything inside it, and you cannot read what it does there.

What changes for compliance

Auditors, regulators and insurers ask the same question after anything goes wrong: what happened, who allowed it, and can you prove it. Laws are starting to ask it in advance. The EU AI Act, for example, requires high-risk AI systems to keep automatic records of what they do. Frameworks such as SOC 2 and ISO 27001 expect evidence that access is controlled and changes are traceable.

An agent makes that hard in two ways. Its actions are many and fast, so evidence has to be collected automatically. And the only record is often the vendor's own log, which is the vendor's account of events rather than evidence the company holds and can check for itself.

One door you control

Excubitor starts from a simple position: you cannot make an agent trustworthy by asking it to behave. You can decide what it reaches, check every action at the moment it happens, stop it without its cooperation, and keep a record nobody can quietly rewrite.

For agents you run yourself, Excubitor sits where the agent acts. Every tool call is checked against the agent's policy before it runs. Outgoing connections are checked against the destinations you allowed, whichever library opens them. Calls to the model are read on the way out and on the way back, so a secret is refused before it leaves. Hidden instructions in a tool's description or answer are kept from the agent. A runaway run is contained by rule, anyone can freeze an agent, and anything irreversible waits for a named person.

For agents that run in a vendor's cloud, no one outside the vendor can see inside them, and we do not claim to. What a company can control is what those agents reach. Put Excubitor's gateway in front of the systems you own, and every action an outside agent takes on them is checked before it runs, can be stopped by your team, and is signed into your record. The agent's credential is checked at the gateway and never passed on, so it never holds the keys to the systems behind it. Systems that are too sensitive for an outside agent stay off its direct connectors.

Evidence for the people who ask

Every action, every refusal and every stop becomes a record chained to the one before, signed every hour. On our hosted service, a single record can be proven to an auditor or an insurer with a short proof they check offline, with our public key, without seeing the rest of the ledger. Records hold fingerprints, not content, so the evidence does not become another copy of sensitive data.

We are careful about what this is and is not. Excubitor does not certify anyone, and we do not claim a mapping to any regulation on your behalf. It gives your assessors evidence they can map to your own controls, and it lets you answer the question "what did the agent do?" with something stronger than a vendor's word.

Where to start

Pick one agent that matters. Write down what it should be able to reach, and what success looks like. Put it behind Excubitor for thirty days, in your own environment if your data requires it, and let your own team check the records with its own tools.

Autonomous agents will do more of a company's work every quarter. The companies that adopt them fastest will be the ones that can show, at any moment, what their agents did and that they could have stopped them. Managed with evidence, never on faith.