Obsidian Security | Report

Your AI agents can act across systems. Can your controls keep up?

Understand the visibility and enforcement gaps that emerge when agents use trusted integrations at machine speed.

Runtime governance of the invisible AI workforce

An AI agent may appear legitimate in one system while its combined access across applications creates a much larger risk. Orphaned tokens, excessive privileges, and cross-system workflows can make that exposure difficult to assess through static access reviews alone.

Traditional security tools were largely designed around human activity. Security leaders now need to consider how agent actions are observed, evaluated, and controlled as they occur.

In this report, Obsidian Security examines the case for runtime governance, discusses Meta's Rule of Two as an evaluation framework, and explores the role of a runtime control plane.

What you'll learn

  • Why agent activity across trusted integrations can escape conventional visibility.
  • How to use the Rule of Two as a lens for evaluating agent exposure.
  • What to consider when moving from access visibility toward runtime enforcement.

Who this report is for

CISOs, enterprise security architects, and AI governance leaders.