Agentic Security

1. Hook This book is being born differently from anything I have written before. I have written seven books. This is number eight — and it is the first one whose creation story is part of the book itself. Because this book is about how humans and AI agents should work together safely — and that is exactly how it is being written. 2. The Posts That Were Actually Chapter One (2024–2025) Two years ago, I wrote a blog post:…

This book was not written from a blank page. It grew from a living canon — a curated, dated collection of theses, architecture concepts, source analyses, and evidence chains that predates the first sentence of every chapter. That canon lives in a persistent personal knowledge base maintained with Vibe, Mistral’s agent workspace. Unlike a chat history, it is durable: every source, every dated insight, and every decision recorded there survives across individual conversations. Work done in one session becomes the…

The third attempt This book is my third attempt to get to grips with the subject of AI safety — and the first where I believe the language is adequate. The first two attempts failed not because of the subject matter, but because of time: the technology was advancing faster than the chapter I was currently writing. Agentic AI has changed that. Not because it has slowed down, but because with the turning point — the moment when agents no…

If you are reading this book at a quiet moment, I’m sorry. I mean: I wish you peace and quiet — but I must rob you of it before we can begin. For the problem at hand has a certain pace, and it is not dramatised. It is measured. One week in October 2026 is enough to illustrate it. Five levels were moving simultaneously during those days. Not one after the other. Simultaneously. And that is the real finding: on…

Control still clings to the external interfaces — but the systems have become standalone swarms. This is the sentence I must place at the beginning, because it underpins everything else in this chapter. It describes not panic, but a shift: the architecture of control — access, interfaces, roles — was built for systems that are controlled at their periphery. And the systems have now outgrown that boundary. They are no longer tools operated by a human. They are swarms that…

The node is the only place in the system where control is faster than emergence. This is not a metaphor, although it sounds like one. It is a technical assertion, and this chapter will substantiate it. For if the second chapter was correct — that control clings to the periphery whilst the action is drawn towards the centre — then the question is not: ‘How do we gain more control?’ The question is: ‘Where exactly must control be situated so…

Responsibility cannot be delegated to architecture — it can only be distributed amongst people. This is the most uncomfortable sentence in this book, which is why I have placed it at the beginning of the most important chapter. For everything we have built up to this point — the diagnosis of the abandoned centre, the node as a checkpoint — boils down to a question that no architecture can answer: Who? Chapter 3 ended with the observation that the junction…

The best controller is not the one who is most skilled with the technology — but the one whom the system cannot outpace. After four chapters on architecture, this is the shortest. Deliberately so. Because the answer to the question ‘Who stands at the junction?’ is not a role, not a certificate, not technological expertise. It is a quality — and it can be described in a single sentence that looks at the book’s central thesis from the other side:…

You cannot force agents to think in a comprehensible way. You can force them to pass through a door that only lets comprehensible thoughts through. Of all the chapters in this book, this is the one with which managers find it easiest to agree — and whose significance they are most likely to underestimate. ‘Semantics’ sounds like linguistics, like academia, like a subject for people with horn-rimmed glasses. In this chapter, I shall show that this is a security problem…

There is one question that is asked in almost every introduction to AI agents, and it is the wrong question to ask. It is: “How do we control what the agent says?” The right question is: “How do we control what the agent does?” The difference sounds small. It is the whole difference. After all, a conversation can be read, corrected or retracted — it is cheap in the literal sense. An action, however, is more costly: it alters balances,…