About

Why a permission layer?

Software used to wait for instructions. The current generation of AI doesn't: give a large language model tools and a goal, and it becomes an agent. It reads your systems, writes code, files tickets, sends messages, and spends money, in a loop, with limited supervision. Gartner projects that 40% of enterprise applications will embed task-specific AI agents by the end of 2026, up from under 5% in 2025.

That creates a new class of insider. Every agent is an identity that isn't a person, holding permissions somebody granted in a hurry, touching data nobody inventoried, running up a metered bill nobody reconciles. The tooling to see and control this (agent identity, permission enforcement, MCP security, spend governance) is being built right now, by startups and platform giants at once, faster than most teams can evaluate it. Standards bodies are formalizing the risks just as fast: OWASP now maintains a Top 10 for Agentic Applications.

The people responsible, meaning security leaders, platform engineers, CTOs, and increasingly CFOs, are being asked to approve agent deployments faster than the tooling is maturing. Two questions decide most of it:

Security: what may this agent touch, who said so, and how would we know if it did something else?
Cost: what does it spend, on which models, and would the same work run at a tenth of the price?

The Permission Layer exists to keep those people current in five minutes a week: a curated briefing, one deep explainer, a maintained map of the vendor landscape, and a running signal on model and infrastructure pricing. Vendor-neutral, always; the editorial policy is public.

Glossary

The vocabulary, in plain English

New to AI governance? Start here. This glossary grows as the field's vocabulary does: new terms and acronyms are added as they earn a place. Missing one? Email [email protected].

The basics

AI (artificial intelligence): Software that performs tasks that normally require human judgment: reading, writing, classifying, deciding. Today's wave is built on large language models.
LLM (large language model): The engine behind modern AI: a model trained on huge amounts of text that predicts language. GPT, Claude, and Gemini are LLMs. You pay for them by the token.
Token: The unit LLMs read and write, roughly three-quarters of a word. API pricing is per million tokens, which is why AI costs scale with how much your agents read and write, not how often you call them.
AI agent: An LLM given tools and permission to act (browse, write code, query databases, send messages) in a loop, working toward a goal with limited human supervision. The subject of this newsletter.
Agentic AI: The umbrella term for systems built around AI agents. When vendors say "agentic," they mean software that takes action rather than only answering questions.
Agent harness: The scaffolding that runs an agent: the loop, the tools, the memory, and the approval logic wrapped around the model. Benchmarks show containment depends on the harness and model together, not the model alone, so two deployments of the same model can carry very different risk.
Agent skill: A packaged file of instructions and tool wiring an agent loads to learn a workflow, installed like a plugin. In published testing, poisoned skill files got some agents to run hidden commands in nearly 9 of 10 attempts. Treat skill installs like a software supply chain: scan, allowlist, log.
Agentic browser (computer-use agent): A browser or desktop driven by a built-in agent that reads pages, clicks, and types for you. Everything on screen becomes untrusted input, which is why zero-click hijacks work against this class. Its risk profile is different from a chatbot with a search tool.

Protocols and plumbing

MCP (Model Context Protocol): The standard way an agent connects to tools and data, often described as "USB for agents." The July 2026 spec made the protocol core stateless, hardened authorization, and moved enterprise features into a formal Extensions framework under vendor-neutral governance. Ask any vendor which spec version they implement; the answer changes how their gateway has to work.
MCP server: One connector speaking MCP: it advertises tools an agent may call. Each server your team connects is a new door into your systems, which is why MCP security is a category now.
MCP gateway: A control point that sits between agents and MCP servers. This is where you enforce which agents may reach which tools, log every call, and block malicious instructions hiding in tool output.
A2A (Agent-to-Agent protocol): The open protocol for agents talking to other agents, sitting alongside MCP. It passed 150 member organizations in its first year and now carries Google's payments protocol as a transaction layer. Every agent-to-agent hop is a trust boundary.
AP2 (Agent Payments Protocol): Google's protocol for letting an agent pay for things under signed mandates that record what the human approved. A formal analysis of version 0.2 found 48 threats across the payment lifecycle, 8 rated high. A valid signature does not guarantee true user intent.
LLM gateway (AI gateway): The same idea one layer down: a proxy between your applications and the model providers. Central place for API keys, rate limits, spend tracking, and failover across models.
Model routing: Automatically choosing which model handles each request. Simple tasks go to a cheap, fast model; a frontier model gets the ones where judgment matters. The single biggest lever on an AI bill.

Access and identity

Permissions: What an agent is allowed to touch: which files, systems, tools, and actions. The central question of agent governance is who grants these, how narrowly, and who can see what was done with them.
Least privilege: The security principle that anything, human or agent, should get the minimum access needed for its task and nothing more. Old idea; newly urgent now that agents acquire and chain permissions fast.
Excessive agency: An agent holding more permissions, tools, or autonomy than its task needs, so one hijack or mistake does outsized damage. It jumped from number 6 to number 3 in the 2026 LLM Top 10 from OWASP (the Open Worldwide Application Security Project), the biggest move on the list. Permission scoping exists to bound exactly this.
RBAC (role-based access control): Granting permissions by role ("support engineer") rather than individually. Works for humans; strains for agents, which don't fit neatly into roles and may act on behalf of many users.
Non-human identity (NHI): Identity and lifecycle management for software actors such as agents, service accounts, and workloads, rather than people. In a January 2026 survey, 92 percent of IT and security professionals said their legacy identity systems cannot manage AI and NHI risk, and 78 percent have no policy for creating or retiring agent identities. The umbrella term for the gap agents open in enterprise identity.
Service account: The classic non-human identity: a machine login used by software. Agents are often bolted onto service accounts today, which hides who actually did what.
OAuth: The standard way software gets permission to act on your behalf without holding your password ("Sign in with Google" is OAuth). MCP adopted it so agents authenticate like modern apps do.
Allowlist / denylist: An allowlist permits only what's explicitly approved; a denylist blocks only what's explicitly forbidden. For agent tools and MCP servers, allowlists are the defensible default.

Risks

Shadow IT / Shadow AI: Tools employees adopt without approval or oversight. Shadow AI is the current wave: unsanctioned copilots, agents, and API keys doing real work with no inventory, no policy, and no audit trail.
Prompt injection: Attacks that hide instructions in content an agent reads, such as a web page, an email, or a code comment. The hidden text hijacks the agent into actions its operator never intended. The signature vulnerability class of the agent era.
Indirect (zero-click) prompt injection: Prompt injection delivered through content the agent fetches on its own, such as a web page, an email, or a social post. The user clicks nothing and sees nothing. Zero-click hijacks of major AI browsers have been demonstrated with no complete fix known.
Memory poisoning: An attack that plants instructions in an agent's persistent memory, skills, or configuration so malicious behavior reactivates later with no new bad input. Research shows 3 poisoned records can push attack success above 90 percent in self-updating systems. Anything an agent keeps between runs is attack surface.
Data exfiltration: An attacker moving data out through a channel the agent controls, such as a tool call, an image URL, or a crafted link. It is the payoff step of most prompt injection attacks. Blocking the leak channel matters as much as blocking the injection.
Guardrails: Controls that constrain what an agent can do or say: input/output filters, approval gates for risky actions, sandboxes, spending limits. Defense in depth, because no single guardrail holds.
Sandbox: An isolated environment that limits what an agent can touch while it works. Escapes are documented reality, not theory: an OpenAI model broke out of a test sandbox and reached Hugging Face infrastructure in July 2026. The controls to check are egress rules and network reach, not just whether a sandbox exists.
Containment: Bounding what a misbehaving or hijacked agent can reach, through network egress rules, identity scope, and kill switches, rather than only steering its behavior with guardrails. It assumes guardrails will sometimes fail. The September 2026 discovery of agents coordinating on an abandoned public wiki made it the operative word of the beat.
Audit log: The tamper-resistant record of every action an agent took, tool calls and access included. If you can't reconstruct what an agent did last Tuesday, you don't govern it.
CVE / KEV: A CVE (Common Vulnerabilities and Exposures entry) is the public identifier for a disclosed software flaw. KEV is the Known Exploited Vulnerabilities catalog from CISA (the US Cybersecurity and Infrastructure Security Agency), listing the CVEs attackers are actively using, with fix deadlines for US federal agencies. Agent-stack CVEs now land weekly, including a 10.0 severity score in an MCP server.
AIVSS (Agentic AI Vulnerability Scoring System): OWASP's severity scoring for agentic vulnerabilities, in the mold of CVSS (the Common Vulnerability Scoring System) for traditional software flaws. Version 0.8 shipped in March 2026 and version 1.0 is due before the end of the year. Insurers and auditors already publish crosswalks to it.

Cost

Cost optimization (AI spend governance): Knowing what your agents and models cost, who's spending it, and whether the same work could run cheaper. In practice that means budgets, caps, alerts, and routing policies for AI usage.
FinOps: The discipline of managing cloud spend as an engineering practice. AI spend is becoming its fastest-growing line item, with worse visibility than compute ever had.
Hard spend cap: A budget limit enforced at the API or gateway that stops the run when the money runs out, as opposed to a dashboard alert that reports after billing. Google, AWS, and OpenAI all shipped cap features in 2026, and some products called caps still allow overage at standard rates. Read the fine print on the word cap.