Deterministic-Controls

In the age of sail, the difference between a privateer and a pirate was a letter of marque — a formal document that scoped authority to a specific enemy, specific waters, and specific timeframe. Captured prizes were adjudicated by courts that evaluated actions against the letter’s terms, not the privateer’s judgment. AI agents carry credentials that say who they are. No credential says what they should be allowed to do right now. Cedar, the first formally verified authorization language, builds the court.

Every firefighter learns the fire triangle on day one. Fire requires fuel, heat, and oxygen. Remove any one and the fire cannot sustain. The lethal trifecta for AI agents follows the same structure. Sensitive data, untrusted input, and external communication. The industry is trying to make the fire burn less. The defense is to remove one element. Which element depends on the deployment.

In 1921, the Soviet government left 800,000 refugees stateless with entry permits from individual countries but no foundational identity binding them together. Fridtjof Nansen solved this with the first internationally recognized identity document for stateless people. AI agents carry the same problem. Three existing identity models fail, the IETF standards solve authentication, and authorization is still your problem.

For fifteen years, the Knoedler Gallery sold $80 million in forged paintings that passed expert authentication. The experts assessed appearance, not provenance. The AI security industry is repeating the pattern with guardrails. Prompt injection and hallucinations share the same root cause in the attention mechanism. The fix is not a better filter. It is a provenance system.

Agentic AI treats every tool-call the same way a 19th-century railroad treated every mile of track: one binary safety mechanism regardless of risk. Alert fatigue defeats the human in the loop, and a single hallucination inherits the developer’s full identity. The solution is not to remove the human but to stop asking the same question regardless of the stakes.