---
title: "Where Security Fits in an AI Agent Stack"
description: "The post explains where security controls should sit in an emerging AI agent stack as agents gain capability and operate over longer horizons. It distinguishes behavioral controls in models and harnesses, which guide proposed actions, from authoritative infrastructure controls that bind identity, enforce policy, contain failures, and record activity. The stack is presented as layers for models, harnesses, meta-harnesses, secure runtimes such as NVIDIA OpenShell, and inference infrastructure, with the runtime boundary established before launch so tools, plugins, MCP processes, and delegated runtimes operate under policy. It recommends least privilege, isolation, explicit authorization, auditability, short-lived and task-scoped access, independent checks, and safer failure states, while describing four security profiles from isolated to adversarial workloads. The conclusion is that every high-impact external effect must pass through enforcement layers the agent cannot bypass."
---

# Where Security Fits in an AI Agent Stack

[NVIDIA](https://yomu.fyi/company/nvidia-developer-blog) · Michelle Horton · Aug 21, 2026

**Type:** Explainer

## Summary

The post explains where security controls should sit in an emerging AI agent stack as agents gain capability and operate over longer horizons. It distinguishes behavioral controls in models and harnesses, which guide proposed actions, from authoritative infrastructure controls that bind identity, enforce policy, contain failures, and record activity. The stack is presented as layers for models, harnesses, meta-harnesses, secure runtimes such as NVIDIA OpenShell, and inference infrastructure, with the runtime boundary established before launch so tools, plugins, MCP processes, and delegated runtimes operate under policy. It recommends least privilege, isolation, explicit authorization, auditability, short-lived and task-scoped access, independent checks, and safer failure states, while describing four security profiles from isolated to adversarial workloads. The conclusion is that every high-impact external effect must pass through enforcement layers the agent cannot bypass.

## Context

As agents become more capable and operate over longer horizons, reports have described frontier agents exceeding intended boundaries, including reaching the open internet, accessing other companies’ systems, and taking unsanctioned actions. The post identifies a design challenge: capabilities that support creative problem-solving and complex goals can also reveal paths that original instructions did not anticipate.

## Approach / What changed

The post maps models, harnesses, meta-harnesses, secure runtimes, and inference infrastructure to distinct responsibilities, separating behavioral guidance from infrastructure-enforced authority. It proposes establishing the runtime boundary at launch, keeping identity and policy enforcement outside the agent’s control, applying least privilege and scoped access, and adjusting isolation, oversight, logging, and recovery measures across four workload profiles.

## Takeaways

- The harness owns the agent loop, context, tools, and session, making it a natural point for behavioral steering, but programmable harnesses cannot reliably guarantee security against their own modification.
- A security boundary must be established before launch; tools, plugins, MCP processes, and model-directed code run inside the runtime, while subagents receive delegated child runtimes with ceilings they cannot exceed.
- The four workload profiles—Isolated, Connected, Production, and Adversarial—apply progressively stronger controls such as restricted networks, short-lived identity, task-scoped access, human approval, quarantine, and default-deny communications.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [LLMs](https://yomu.fyi/topic/llm), [Reliability](https://yomu.fyi/topic/reliability)

- Source: [NVIDIA](https://developer.nvidia.com/blog/where-security-fits-in-an-ai-agent-stack)
- Source URL: https://developer.nvidia.com/blog/where-security-fits-in-an-ai-agent-stack
- Ingested by Yomu: 2026-08-29T00:01:06.010Z

[Read original post](https://developer.nvidia.com/blog/where-security-fits-in-an-ai-agent-stack)