Describing Security Principles for Agentic Systems

In an enterprise increasingly powered by AI agents, traditional security measures designed for human users or static applications fall short. These agents make autonomous decisions, access external tools, and operate across various systems, introducing new categories of risk. This lesson explores how to secure these dynamic, intelligent systems, ensuring that agents operate within defined boundaries, maintain trust, and adhere to strict governance while unlocking their full potential.

The rise of agentic AI introduces unique security challenges that traditional frameworks were not designed to address. Agents, with their ability to make autonomous decisions and interact across diverse systems, expand the attack surface and create new vulnerabilities. To counter these risks, a robust security approach is essential, treating agents not merely as tools, but as first-class principals within the enterprise security landscape.

In an AI-native model, agents are recognized as distinct entities that require their own identity, authorization, and governance, much like human users or critical applications. This means:

Agent Identity

Each agent carries its own unique digital identity, combining an application registration with policy assignments for persistent roles. This identity is cryptographically verifiable, ensuring that every agent's origin and authenticity can be trusted.

Scoped Delegable Authorizations

Agents do not inherit a user's full permissions. Instead, users can grant agents a carefully bounded subset of their permissions for unattended execution. This ensures agents never act beyond their explicitly authorized scope, for example, restricting them to non-destructive operations.

Governance and Auditability

All agent actions are governed and auditable. This includes tracking their behavior, decision-making processes, and interactions. Third-party agents must also authenticate via identity services, and those without valid credentials are denied access, maintaining governed access across trust boundaries.

This fundamental shift ensures that trust converts an agent's capability into permission to act, allowing them to execute across real workflows while accumulating institutional judgment securely.

SAP's three-tier AI defense architecture provides a progressive and comprehensive framework to address agentic threats, integrating traditional controls with agent-specific oversight and AI-powered automation.

Foundation tier

Zero-trust authentication, traffic inspection, prompt-injection detection, behavioral analytics, and cryptographically verifiable agent credentials. Entities are validated, and actions are recorded.

Supervision tier

Deterministic control agents that monitor, sanitize, and authorize other AI agents. These supervisory agents enforce input validation, output filtering, and anomaly detection—with human oversight for high-risk decisions.

Automation tier

Specialized AI agents that scale security operations through continuous audits, risk assessment, and policy enforcement. Identity management agents handle provisioning and contextual authorization. This layer embeds secure development practices into AI-assisted workflows, helping ensure AI-generated code is validated and compliant before release.

By deploying these specialized agents, security operations become more efficient, scalable, and capable of preventing risks rather than just reacting to them. Together, these three tiers form a comprehensive defense strategy, enabling the secure and responsible deployment of agentic AI systems within the enterprise.

• Agents as First-Class Principals: AI agents are treated with their own identity, scoped authorizations, and governance, similar to human users, to manage new security risks.
• Three-Tier AI Defense Architecture: SAP employs a progressive three-tier model for agentic security: Foundation, Supervision, and Automation.
• Foundation Tier: Ensures zero-trust authentication, traffic inspection, prompt-injection detection, and cryptographically verifiable agent credentials.
• Supervision Tier (Deterministic Control Agents): Uses specialized control agents to monitor, sanitize, authorize, and enforce policies for other AI agents, with human oversight for critical decisions.
• Automation Tier (Specialized AI Agents): Leverages AI agents to automate security operations, including continuous audits, risk assessment, policy enforcement, and embedding secure development practices.