Defining deny by default in enterprise AI agent security
Deny by default in AI agent security is a zero permission default model where autonomous agents start with no access to data, systems, or tools, and must receive explicit, granular permissions before taking any action, giving enterprises deterministic control over what agents can do even when their reasoning is probabilistic and sometimes unpredictable. This idea is moving from theory to requirement as enterprises realise most early AI pilots gave agents broad, loosely monitored access to internal knowledge bases, developer tools, and the open internet. In many cases, agents can do more than leaders have formally approved. Security and AI teams now see that permissive defaults do not mix well with autonomous systems that operate at machine speed and act as “mini engineers.” Deny by default puts a hard boundary around actions, not ideas, and makes every new capability an intentional choice instead of an accidental exposure.
From lethal trifecta to zero-permission default architectures
ServiceNow and NVIDIA engineers describe a “lethal trifecta” for AI agent risk: unfettered internet access, internal knowledge bases, and coding terminals running in a single autonomous agent. Any two of these may be acceptable, but all three together create an attack surface traditional governance cannot handle. To respond, NVIDIA’s Open Shell introduces a zero-permission-by-default sandbox that sits between agents and enterprise infrastructure. When an agent launches, every permission check returns no until administrators grant tightly scoped actions, which are logged and enforced at runtime. This flips the old subtractive model—grant everything, then block problems—into an additive one where access only grows through deliberate approvals. It extends the familiar zero-trust approach from human users and devices to AI agents, so each agent identity is confined to specific APIs, datasets, and workflows instead of roaming freely across the environment.
Kill switches and rogue AI agent control become board-level demands
Identity platforms are now being asked not only to authenticate AI agents, but to stop them. Okta reports that 92 percent of executives see moderate or widespread use of autonomous AI agents, yet only 22 percent say those agents have identities tied to them. That gap makes classic “rogue AI agent control” difficult, because there is no clean way to cut off access once an agent is in flight. ServiceNow pressed for a kill switch that can sever connections when agents ignore policy. Okta’s leadership describes this as the ability to revoke tokens and break the logical link to backend resources at the authorization layer. Within ServiceNow’s AI Control Tower, risky agent behaviour can trigger automated remediation, including calls to Okta and Veza, allowing teams to revoke permissions or shut down an agent’s sessions in seconds instead of after a lengthy investigation.
Why deny by default forces a rethink of enterprise AI governance
Traditional security models assumed access by default and added controls later through firewalls, network zones, and after-the-fact monitoring. Enterprise AI governance is moving in the opposite direction: zero permission default, explicit grants, and continuous enforcement. In platforms like Open Shell, agents receive identities comparable to user accounts, with entitlements that define which records, tools, and services they can touch. Even if an agent “decides” it wants to update a payroll system or modify code in a repository, the runtime layer can deterministically block the call if the permission is missing. Okta’s CEO notes that many teams still connect agents to systems such as GitHub and Jira using static tokens on developer machines, a pattern that leaves no reliable kill switch or audit trail. Deny by default replaces these ad hoc links with governed identities, clear scopes, and revocable access paths.
Designing mission-critical AI agents around explicit permission grants
As AI agents move into mission-critical workflows, the idea that they “might” do the right thing is no longer enough. Enterprises are converging on designs where agents must request capabilities from a control plane, and each grant is narrow: one dataset, one API, one environment. ServiceNow’s AI Control Tower illustrates this shift, orchestrating policies across identity systems and mapping permissions for human, machine, and AI identities. When behaviour drifts from policy, the platform can downgrade permissions or trigger a full kill switch. This model treats AI agents as first-class identities with lifecycle management, rather than as plugins hiding behind a human user’s credentials. The result is a governance posture where deny by default is not a temporary guardrail but the foundation of AI agent security, and where every new permission is a conscious, auditable decision aligned to business risk.
