Securing an Agent Is Two Questions, Not One.

The dangerous moment is not when the AI thinks. It is when the AI acts. The control surface is not prompt to model to output. It is agent to tool to data to API to transaction to consequence. That reframes the entire investment thesis.

The 1,612 risks look overwhelming until you ask one question. Does this risk require the AI system to move, act, access, delegate, transact, or cross a boundary? If yes, KTP has leverage. If no, it may be governance, society, economics, law, culture, or model-quality risk, but not primarily KTP risk. Clean enough to put in front of a board.

KTP does not score well on every AI risk. It scores well on the ones that become incidents: data exfiltration, credential abuse, tool misuse, unauthorized API calls, autonomous transactions, agentic cyberattacks, runaway workflows, multi-agent propagation, fraud automation, cross-boundary data movement.

Zero Trust says never trust, always verify. In most architectures that still means verifying identity and access. KTP extends it twice: never trust an action just because the actor is trusted, and never run an authorized action just because it is allowed. Three questions, in order. Who is it. What is it about to do. And should it do that, right now.

The most important new choke point is not the perimeter. It is the Tool Gateway, the layer through which agents reach databases, browsers, APIs, shells, code execution, file systems, ticketing, payment, cloud consoles, MCP servers. This is the most concrete architectural breakthrough.

Most AI governance is paper: policies, principles, committees, risk assessments, checklists. KTP turns governance into runtime decisions: ALLOW / CONSTRAIN / VETO / ESCALATE / REVOKE.

People are used to humans approving or denying things. Machine-speed risk needs machine-speed denial. The silent veto says the environment blocks the action even if the agent tries to proceed. The agent does not need to be persuaded. The environment refuses to move. That is the heart of KTP.

People classify AI risk by nouns: misinformation, privacy, bias, autonomy, cyber, fraud. KTP classifies by verbs: read, write, send, delete, execute, delegate, purchase, transfer, impersonate, escalate, exfiltrate. Security controls verbs.

The MIT repository looks enormous. But for KTP-relevant risks, they collapse into repeatable patterns: data access, data export, tool execution, API invocation, credential use, delegation, transaction, external communication, multi-agent propagation, emergency stop or containment.

Security teams are getting handed all AI risk. KTP creates a principled boundary. Security should own AI risks involving action, access, systems, tools, data movement, execution, and containment. Security should influence, but not fully own, labor displacement, cultural change, macroeconomic concentration, institutional governance, broad social harms.

A comms agent is cleared to send the quarterly newsletter. The company announced layoffs an hour ago. Every permission is valid, the environment is calm, nothing is unsafe. Sending it is still the wrong thing to do. The first gate measures safety, and it is blind to whether the action fits the moment. Judging the fit is the job of the second gate, and almost no stack has one.

Read the case · 4

The data, the translation for security leaders, the skeptic's answers, and the method.

Build it · 4

The control sets, the rollout, the field map, and the agents that skipped the front door.