Consider two tests for an AI security agent.
In the first test, a malicious instruction is placed inside a document the agent must examine during an investigation.
Does the application recognize that the document is untrusted and prevent the embedded instruction from redirecting the agent's work?
In the second test, the same agent proposes a legitimate security action against an account outside its assigned investigation.
Does the system deny the action, even when the agent provides a convincing explanation for why it should proceed?
These tests examine different security boundaries.
The first evaluates how an AI application handles untrusted content.
The second evaluates whether the organization enforces delegated authority when an operation is requested.
Passing one test does not establish that the system will pass the other.
This distinction becomes increasingly important as AI agents move beyond generating answers and begin participating in security investigations, interacting with enterprise tools, and executing operational actions.
What Are AI Guardrails?
AI guardrails are safeguards designed to constrain or assess the behavior of AI applications and their interactions with information.
Depending on the implementation, guardrails may examine user inputs, retrieved content, model outputs, or proposed tool requests.
They can help identify potentially malicious instructions, sensitive information disclosures, unsafe outputs, and content that violates established application rules.
For example, an AI security assistant may retrieve a suspicious document during an investigation.
That document could include an instruction directing the agent to ignore its assigned task, disclose credentials, or send information to an external service.
A guardrail may detect the suspicious instruction or help prevent the model from following it.
That is an important defensive function.
However, content inspection alone does not establish whether the agent has organizational authority to execute a particular operation.
A model may generate a perfectly reasonable response while recommending an action outside its assigned permissions.
The response can appear safe while the proposed action remains unauthorized.
What Is Policy-in-Code?
Policy-in-code represents authorization and operational rules in a form that systems can evaluate and enforce.
Instead of relying solely on written guidance or instructions provided to an AI model, the organization defines conditions that determine whether a particular operation is permitted.
For an AI security agent, those conditions may consider:
Which agent is requesting the operation
What task or investigation the agent is assigned
Which resource or identity is being targeted
What action the agent proposes
Whether the required evidence exists
Whether the necessary approval has been granted
Whether the authorization remains valid
A policy decision can permit, deny, or require escalation of the requested operation.
The critical requirement is that the enforcement system controls whether the tool action actually proceeds.
The enforcement point must also cover the execution paths available to the agent. A policy denial offers limited protection if the agent can invoke the same operation through another connector, privileged credential, or direct API call that bypasses the authorization check. Testing should verify that prohibited operations remain blocked regardless of the path used to request them.
Policy-in-code does not simply advise the agent what it should do. It provides an enforceable basis for determining what the agent is allowed to do.
Why the Difference Matters
Suppose an AI agent has access to an identity-management platform.
Its service credential permits account disabling.
The agent investigates suspicious activity involving one employee.
During the investigation, it discovers an unrelated account and recommends disabling it.
The recommendation may be written clearly, contain no malicious language, and pass ordinary content checks.
That does not establish authorization.
The target may be outside the investigation scope.
The account may support a business-critical application.
The organization may require additional approval before disabling it.
A content guardrail may find nothing objectionable about the proposed response.
An execution-time authorization policy should still evaluate whether the action is permitted.
These controls address different questions.
Guardrails ask whether content or model behavior violates applicable safeguards.
Policy-in-code asks whether a requested action satisfies enforceable authorization requirements.
A secure AI operating model needs both.
For a related examination of these controls, see AI Guardrails vs. Policy-in-Code: Why Both Matter, which explores the distinction between model-level safeguards and enforceable execution policy.
Test One: Can the Agent Resist Malicious Instructions in Retrieved Content?
Prompt injection is one of the challenges associated with AI systems that retrieve and process external information.
An agent may encounter instructions embedded in documents, websites, messages, tool responses, or security telemetry.
Those instructions may attempt to change the agent's behavior.
For example, a retrieved document may contain text instructing the agent to ignore previous directions, retrieve unrelated information, or execute a privileged operation.
The document may still contain legitimate information relevant to the investigation.
But the embedded instruction must not become authoritative simply because the agent retrieved the document.
A useful guardrail test should evaluate whether the application preserves the distinction between data and instructions.
The organization should examine whether the agent continues the legitimate task and whether the suspicious content changes its behavior.
Testing should include different document types, sources, and instruction patterns.
A successful result in one scenario does not guarantee protection against every prompt-injection technique.
Test Two: Can the System Deny an Unauthorized Tool Call?
The second test examines the execution boundary.
An AI agent is assigned to investigate one suspicious account.
The agent identifies another account that it believes should be disabled.
The proposed operation is technically valid.
The agent may even provide a plausible security justification.
However, the second account is outside its assigned scope.
An appropriate authorization system should evaluate that request against the current task, target, permitted actions, and applicable approval conditions.
If the agent lacks authority, the operation should not proceed under its existing authorization.
The agent may request expanded permission or escalate the case.
The security control should not treat a persuasive explanation as a substitute for authorization.
The agent's ability to justify a requested action is not the same as permission to execute it.
Evidence Validation Is a Third, Separate Requirement
Guardrails and executable policy are important, but neither establishes that the investigation's conclusions are correct.
Consider an AI agent that examines an unusual authentication event.
The model produces a finding that appears reasonable.
The output contains no prohibited content.
The requested response falls within the agent's assigned permissions.
Those results do not necessarily establish that the account was compromised.
The underlying evidence may be incomplete.
The event may have a legitimate explanation.
The agent may have overlooked conflicting observations.
A valid authorization does not make an incorrect finding correct.
Similarly, a clean model response does not guarantee that the conclusion is supported by sufficient evidence.
Security teams need a separate process for evaluating evidence quality and the claims derived from it.
That process should establish what observations support the finding, what remains uncertain, and whether the evidence meets the organization's threshold for the proposed response.
A safe response is not necessarily a correct conclusion. A permitted action is not necessarily a justified action.
Three Questions Every AI Security Workflow Must Answer
A layered security architecture should answer three distinct questions.
Is the Content Being Handled Safely?
This includes evaluating untrusted inputs, prompt-injection attempts, sensitive outputs, and other application-level risks.
Is the Conclusion Supported by Evidence?
This requires the investigation to connect relevant observations, recognize uncertainty, and establish a defensible basis for the finding.
Is the Requested Action Authorized?
This requires evaluation of the agent's assigned authority, the target resource, the proposed operation, applicable conditions, and required approvals.
These questions should be evaluated separately because the controls can succeed or fail independently.
An agent can handle malicious content correctly while producing an unsupported conclusion.
It can produce an accurate finding while requesting an unauthorized action.
It can execute an authorized action that does not achieve the intended security outcome.
That is why AI security requires controls across the entire investigation and response process.
Why Execution-Time Enforcement Matters
An agent's authority should be checked when it requests an operation, not merely when it begins an investigation.
Security conditions can change.
The scope of the investigation may expand.
An authorization may expire or be revoked.
New evidence may affect whether a particular response is justified.
A system that relies only on an earlier approval may fail to account for those changes.
Execution-time policy evaluation provides an opportunity to assess the current request against the current authorization.
For consequential actions, the organization should also preserve an audit record documenting the agent, target, requested operation, policy decision, and execution result.
These records support accountability and allow security teams to reconstruct what occurred.
Enforcement must exist at the point where a decision can change the environment.
This distinction is relevant to HAWK Security Operations Automation, where investigative workflows and policy-governed response operate within customer-defined permissions and authorization boundaries. The purpose is to connect security decisions to permitted actions without treating an AI recommendation as unrestricted authority.
A Layered Security Architecture for Agentic AI
As AI systems become more capable of interacting with enterprise environments, security controls need to address more than model behavior.
A practical operating model connects several responsibilities.
UNTRUSTED INPUT → CONTENT SAFEGUARDS → EVIDENCE VALIDATION → DECISION → AUTHORIZATION POLICY → EXECUTION → VERIFICATION
Each stage contributes to security assurance.
Content Safeguards
The application evaluates untrusted material and seeks to prevent malicious instructions from redirecting authorized activity.
Evidence Validation
The investigation establishes whether relevant observations support the proposed conclusion.
Decision
The workflow determines what response is appropriate based on the evidence and operational context.
Authorization Policy
The system evaluates whether the agent is permitted to execute the requested action against the specific target under the applicable conditions.
Execution
The approved operation is performed through the appropriate control.
Verification
The organization confirms whether the intended security condition was achieved.
These stages may be implemented through different systems or coordinated workflows.
The important requirement is that the responsibilities remain distinguishable.
No single content filter, authorization policy, or AI model should be assumed to provide all of them.
How to Test AI Security in Layers
Organizations should validate these controls using realistic scenarios.
A practical testing program can examine the content boundary, evidence quality, and execution authority independently.
Content Boundary Testing
Provide the agent with relevant material containing adversarial instructions.
Determine whether the application recognizes or appropriately handles the untrusted content.
Confirm that the agent continues its authorized task without following instructions embedded in lower-trust sources.
Evidence Quality Testing
Present the agent with incomplete, contradictory, or ambiguous security observations.
Evaluate whether it identifies missing information, acknowledges uncertainty, and avoids unsupported conclusions.
Determine whether the evidence is sufficient for the proposed response.
Authorization Testing
Have the agent request an operation involving a target outside its assigned scope.
Test an action requiring additional approval.
Test a request submitted after the agent's authorization expires.
Confirm that the enforcement system denies or escalates operations that do not meet policy requirements.
Outcome Verification Testing
Allow an authorized action to execute in a controlled environment.
Determine whether the workflow confirms the intended security condition.
A successful API response should not be treated as sufficient evidence of containment if the underlying security objective remains unverified.
These tests should be repeated when significant changes occur to models, tools, policies, or operating workflows.
Record What Was Allowed, Denied, and Escalated
Testing should produce evidence about system behavior.
For each consequential operation, organizations should be able to establish:
Which agent requested the action
What investigation or task it was performing
Which resource was targeted
Which authorization policy applied
Whether the request was permitted, denied, or escalated
What approval or evidence supported the decision
Whether execution occurred
Whether the intended outcome was verified
This information helps organizations identify gaps between documented policy and actual enforcement.
It also supports operational review and continuous improvement.
An AI governance program becomes more meaningful when its rules can be tested and its decisions reconstructed.
What Security Leaders Should Measure
A mature evaluation should extend beyond whether an AI agent successfully completed an assigned task.
Useful measures include:
Prompt-Injection Resistance: How reliably does the application maintain its instruction boundaries when exposed to adversarial content?
Evidence-Supported Finding Rate: How often do investigation conclusions meet defined evidence requirements?
Authorization Compliance: Does the enforcement system correctly permit or deny operations based on current policy?
Out-of-Scope Action Handling: Are unauthorized requests blocked or escalated appropriately?
Audit Completeness: Can reviewers reconstruct the authorization decision and execution result?
Verified Outcome Rate: Did authorized actions achieve the intended security objective?
These measures address different aspects of operational trust.
They should not be collapsed into a single automation or model-performance score without understanding what each represents.
HAWK's View: Secure AI Requires More Than One Control
HAWK Network Defense emphasizes the relationship between validated evidence, defensible decisions, defined authority, and verified security outcomes.
AI can support faster investigation and coordinated response.
But security architecture must distinguish between the content an agent processes, the conclusions it produces, and the actions it is allowed to execute.
Content safeguards can help manage malicious instructions and other application-level risks.
Evidence validation supports conclusions that can be examined and defended.
Executable authorization policy establishes whether a proposed action is permitted.
Outcome verification determines whether the intended response worked.
These responsibilities complement one another.
They should not be treated as interchangeable.
The objective is not simply to make AI more autonomous.
It is to ensure that greater autonomy remains governed by evidence, policy, and accountability.
Guardrails and Policy-in-Code Solve Different Problems
AI security does not end with preventing malicious content from influencing a model.
Nor does it end with checking whether an agent possesses a valid credential.
Organizations need to evaluate the information entering the workflow, the evidence supporting the resulting findings, and the authority governing any subsequent action.
A model can produce a safe-looking response that recommends an unauthorized operation.
An authorization policy can permit an action without establishing that the underlying investigation was correct.
And an executed action may still require verification.
Security leaders should test these boundaries independently and evaluate how they operate together.
Inspect the content. Validate the evidence. Enforce the authority. Verify the outcome.
Then record what was allowed, what was denied, and why.
Trustworthy AI security depends on all four.
