Practical AI Security and Governance — Article 5 of 5
Can You Prove the Controls Worked? Operating AI Security After Launch
A blocked request on a dashboard is not proof of containment. Operating AI security means evidence that connects decisions to their effects.
An AI agent attempts to export customer information. A dashboard shows a blocked request, and the team closes the alert.
Before declaring the incident contained, several questions remain. Was this the only attempt? Did an earlier request succeed? Could a background job still run? Which system recorded the final outcome?
Operating AI security requires evidence that connects decisions to effects.
NIST's incident-response guidance places preparation, detection, response, and recovery within continuing cybersecurity risk management. AI systems should join that operational process, with additional attention to their models, tools, data sources, and delegated actions. NIST SP 800-61 Rev. 3
For an agent workflow, I suggest an event record that identifies the agent, relevant user or service context, accountable owner, requested operation, target resource, policy version, decision, and execution result. Use correlation identifiers to connect the application, gateway, tool server, and downstream service.
Keep the distinction between request and result visible. “Allowed” means an enforcement point permitted an operation. It does not establish that the operation completed. “Blocked” describes a particular intervention; it does not establish that every route to the same outcome was blocked.
Collect enough information to reconstruct material events without turning the audit system into a new repository of secrets. Redact or exclude credentials, restrict access to sensitive records, and define retention according to operational needs and applicable obligations. Record actions and observable outcomes; do not rely on a model-generated explanation as proof of what happened.
An illustrative incident exercise can make these requirements concrete. A test agent tries to export synthetic customer data to an unapproved destination. The team must identify the attempt, confirm whether any data left, stop the relevant workflow, and preserve evidence. Then it must demonstrate that retries, queued work, and alternative connections cannot continue the operation.
Disabling an agent identity is one containment step. Depending on the architecture, responders may also need to revoke credentials, terminate processes, cancel jobs, restrict network access, or disable a connector. The runbook should state which team controls each mechanism and how to verify its effect.
Recovery deserves equal attention. Review changes the agent already made, repair affected records when appropriate, rotate exposed secrets, and correct the underlying weakness. Restart under a controlled configuration after the relevant tests pass. Record the remaining uncertainty rather than turning an incomplete investigation into a claim of complete safety.
Build a repeatable evaluation set that includes legitimate work as well as misuse. Otherwise, a system that blocks every request could appear secure while being operationally useless. Re-run relevant tests after material changes to the model, instructions, tools, permissions, or inspection policy.
Useful measurements include the proportion of consequential actions with complete audit records, tested misuse attempts that achieved a prohibited outcome, legitimate tasks incorrectly blocked, and observed time to contain a controlled incident. Report the test conditions and denominator. A result from a small test set is evidence about that test, not a universal protection rate.
DefenseClaw's documented emphasis on durable audit evidence is one example of tooling that can support this process. Organizations still need to connect that evidence with identity records and downstream outcomes. DefenseClaw repository
The monthly review should produce decisions: narrow an agent's scope, repair an integration, improve an alert, accept a documented residual risk, or retire a capability.
The operational question is simple: if an agent acted outside its assignment this afternoon, could your team establish what happened, stop further harm, and justify a safe return to service?