I responded to NIST's AI agent security RFI. Here's why authorization scope matters more than human oversight and what the data shows about machine-speed threats.
The authorization scope framing matches what we ran into in production.
We built a certifying proxy that sits between AI agents and the APIs they call. Every action passes through it, gets scoped, gets an independently verifiable
proof. The agent never touches the upstream API directly. We ended up in exactly the world you're describing, constraining what the agent can do at execution
time rather than watching what it did afterward.
What surprised us is that blast radius stops being theoretical once you have this. When every action passes through a single enforcement point with a
cryptographic receipt, you can map exactly which APIs were touched, in what order, with what payloads. If an agent is compromised or hallucinating its way
through a tool chain, the damage surface shows up in the proof trail before any human reviews anything. The 97% excessive privilege stat is terrifying for that
reason: there's no instrumentation to even see the blast radius in most setups.
The 144:1 ratio lands hard for a reason your piece doesn't fully surface. In real pipelines, one workflow might chain Claude, Mistral, and a self-hosted model
across different providers. AWS can scope its own agents, Anthropic can scope Claude, but no single vendor enforces authorization across the full chain. That
gap only closes with an independent layer that doesn't belong to any of the providers.
On the 60-70% coverage estimate, I'd call that generous, specifically on the verification side. Having authorization constraints doesn't mean you can prove
they were enforced during execution. Scope without evidence is just policy on paper.
The authorization scope framing matches what we ran into in production.
We built a certifying proxy that sits between AI agents and the APIs they call. Every action passes through it, gets scoped, gets an independently verifiable
proof. The agent never touches the upstream API directly. We ended up in exactly the world you're describing, constraining what the agent can do at execution
time rather than watching what it did afterward.
What surprised us is that blast radius stops being theoretical once you have this. When every action passes through a single enforcement point with a
cryptographic receipt, you can map exactly which APIs were touched, in what order, with what payloads. If an agent is compromised or hallucinating its way
through a tool chain, the damage surface shows up in the proof trail before any human reviews anything. The 97% excessive privilege stat is terrifying for that
reason: there's no instrumentation to even see the blast radius in most setups.
The 144:1 ratio lands hard for a reason your piece doesn't fully surface. In real pipelines, one workflow might chain Claude, Mistral, and a self-hosted model
across different providers. AWS can scope its own agents, Anthropic can scope Claude, but no single vendor enforces authorization across the full chain. That
gap only closes with an independent layer that doesn't belong to any of the providers.
On the 60-70% coverage estimate, I'd call that generous, specifically on the verification side. Having authorization constraints doesn't mean you can prove
they were enforced during execution. Scope without evidence is just policy on paper.
Implementation details at https://arkforge.tech and a real API call, independently verifiable: https://trust.arkforge.tech/v1/proof/prf_20260313_145317_c69de2