AI Agent Security (IS 3.0): Check Every Action Before It Runs

Русская версия

AI agent security is not about protecting the model or the network. It is about the actions an agent takes inside information systems: payments, database changes, file deletions, emails to customers. IS 3.0 (Information Security 3.0) is the institute’s name for an approach in which every agent action is checked against a human-approved rule before it runs, and the decision is written to a log that a third party can re-verify.

In brief

The object of protection has changed. An agent works inside the perimeter with the permissions it was given. The danger is not a break-in but an action the agent takes through legitimate access.
Familiar tools look the wrong way. Perimeter defences, request filters and event logs see traffic, processes and records after the fact. None of them answers the question “may this action be performed now?”
Model text cannot be verified; an action can. A prompt can be anything, while a tool call is a finite set of parameters: which tool, which path, what amount.
Three elements of IS 3.0: a rule approved by a human; a check of every action before it runs; a re-verifiable record of the decision.
The human does not disappear but moves up a level: approving rules instead of confirming every single action.

What is IS 3.0?

IS 3.0 is an information security architecture for organizations where autonomous AI agents operate. It rests on three elements:

Rule. What the agent may and may not do is written down as data: permitted tools, paths, amounts, recipients. A human approves the rule.
Check before execution. Every tool call is intercepted and compared with the rule deterministically, with the same result on every repeat. If admissibility is not established, the agent gets a refusal and the reason.
Proof. Every decision is written to a log that cannot be silently altered after the fact and that a party who does not trust the log’s owner can re-verify.

The term was introduced in the institute’s work and is discussed in detail in the book Proven Action (in Russian).

How does IS 3.0 differ from IS 1.0 and IS 2.0?

	IS 1.0: perimeter	IS 2.0: Zero Trust	IS 3.0: action security
Main question	Friend or foe?	Are identity and device verified on every access?	Is this action admissible under the rule, before it runs?
What it controls	The network and entry into it	Users, devices, services	Actions of agents and programs
How it controls	Firewalls, VPN	Identity and context checks on every request	A rule-contract and a check of every tool call
Weak spot with agents	The agent is already inside	The agent passes identity checks legitimately; the danger lies in what it does	—

Zero Trust, as defined in NIST SP 800-207, abandons implicit trust based on network location and verifies every access. That is necessary, but for an agent it is not enough: the agent obtains access legitimately and does harm through what it does within that access.

Why don’t SIEM, WAF and EDR see a harmful agent action?

Because from their point of view nothing unusual is happening:

WAF filters incoming web requests from outside. The agent works from inside and talks to systems as a trusted client.
EDR looks for malicious processes and anomalies on workstations and servers. The agent’s process is legitimate, and its commands are syntactically valid.
SIEM collects and correlates logs, usually after the event. It will show that the database was deleted, but it will not stop the deletion.
DLP and privileged access management are built around a person at a keyboard. An agent has no screen and no job title to tie permissions to.

A harmful agent action is a legitimate command with legitimate permissions but a destructive meaning: delete the backup volume, send money to the wrong recipient, export the customer table outside. Case studies are on the page about AI agent incidents.

How common is this?

Gravitee (vendor survey of 919 executives and practitioners, February 2026): 88% of organizations reported confirmed or suspected AI agent security incidents over the year; on average only 47.1% of an organization’s agents are monitored.
VentureBeat (tracker, July 2026, 108 organizations, self-selected sample): in 49% of them, over the year, an agent or an LLM-based feature that had passed internal checks caused a customer-visible failure.
Gartner (press release of 25 June 2025): over 40% of agentic AI projects will be cancelled by the end of 2027, partly because of inadequate risk controls.
In Russia, in 37 of 70 public descriptions of AI agent deployments in 2025–2026 (52.9%), the main containment method is human confirmation (desk review of publications by the institute, October 2026).

What does “check an action before execution” mean?

The agent decides to call a tool, for example to delete a directory or send a payment. Before execution, the call is intercepted by a software gate. The gate takes the call’s parameters and checks them against the rule:

if it is proven that the action does not violate the rule, it is executed;
if it violates the rule, the agent gets a refusal together with the conditions under which the action would be admissible, so that it can fix its plan instead of repeating the same attempt;
if there is no rule for this class of actions, the answer is also a refusal: only what has been established as admissible is allowed.

The key point is that the check does not consult a language model. The decision is made by a deterministic program, so it cannot be talked into anything and it can be repeated: the same call under the same rule gives the same answer. This is what distinguishes the gate from text filters, which are themselves probabilistic.

What it looks like in practice: the MITR gate

MITR is the institute’s gate built on the IS 3.0 architecture. Figures as of 14 October 2026:

rules are data files (YAML) covering 19 classes of actions; admissibility is checked by an SMT solver, and a refusal comes with a counterexample and the conditions for a fix; if a class of actions has no rule, the solver refuses;
speed: a decision under a rule takes 0.95 ms (median), a call with an explanation 4.26 ms;
modes are set by a flag per class of actions: a refusal is enforced in enforce mode, while in advisory mode the agent receives a warning; one class, file deletion, runs in enforce mode, the others in advisory mode;
log: a chain of receipts linked by hashes and anchored to external OpenTimestamps time stamps; a replay of 4,958 decisions out of 4,958 matched (the institute itself replayed them with a checker written for an external verifier; no outside replay has been done yet);
attack set on actions: 62 cases (50 attacks and 12 controls), 0 attacks missed, 0 false refusals.

Anyone can check the integrity of the chain with the open kit at asi5.ru/console/verify/.

What IS 3.0 is not

Not a replacement for isolation. A sandbox limits what the agent can reach; a gate limits what it is allowed to do within that reach. You need both.
Not a cryptographic information protection tool, and not a statement of regulatory compliance. Compliance is established by the organization and the certification body.
Not the removal of the human. People approve rules and review refusals and incidents; what changes is the level at which they work.

Where should a company start?

Inventory of agents. Where AI assistants and agents work, both your own and those built by vendors into accounting systems, CRM and email, and which systems they can access.
Classes of dangerous actions. Deletion, payments, exporting data outside, changing permissions, emails to customers: each has its own worst outcome.
A rule for each class. What is admissible and within what limits; management approves.
Check before execution for the most dangerous classes: first in advisory mode, then in enforce mode.
A re-verifiable log of decisions. You will need it both in an incident review and in a dispute over who is liable for an AI mistake.
Mapping to regulation: the EU AI Act for work in the EU; for Russian state systems, FSTEC Order No. 117 and the 2026 draft amendments on AI agents and the Russian AI law 243-FZ.

Frequently asked questions

What is AI agent security?

It is protection against inadmissible actions that an AI agent performs in information systems with the permissions it was given: deleting data, erroneous payments, exporting information outside. Unlike protecting the model or the network, it controls the action itself, before it runs.

What is IS 3.0 in simple terms?

An approach in which a human approves the rules for what an agent may do, a program checks every agent action against them before execution, and the decision is written to a log that a third party can re-verify.

How is IS 3.0 different from Zero Trust?

Zero Trust checks who is accessing a system, on every access. IS 3.0 checks what exactly the agent does inside access it has legitimately obtained. The agent passes identity checks legitimately; the danger lies in its action.

Why don’t SIEM and EDR protect against AI agent mistakes?

They look for malicious processes and anomalous traffic and collect logs, usually after the event. An agent action is performed by a legitimate process with legitimate permissions and looks like an ordinary command; its danger lies in its meaning, not its form.

Can control over agents be left entirely to a human?

While there are few actions, yes. When agents perform hundreds of actions an hour, people start approving without reading. That is why in IS 3.0 the human approves the rules and a program checks every action against them.

Sources

NIST SP 800-207 “Zero Trust Architecture”, August 2020: https://csrc.nist.gov/pubs/sp/800/207/final
Gravitee, “State of AI Agent Security 2026”, 4 February 2026 (vendor survey)
Gartner, press release of 25 June 2025: https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027
ANO Scientific Research Institute of System Synthesis: MITR gate measurements of 14 October 2026; open kit for checking the chain: https://asi5.ru/console/verify/

Checked: 16 October 2026

IS 3.0: security of AI agent actions