Detection tells you what is happening. Authorization decides what is allowed to happen. Most AI agent security programs invest heavily in the first and assume it delivers the second, and the gap between the two is where agent incidents live.
Four controls, four different jobs
The word "guardrails" gets used for at least four different controls, and conflating them is how programs end up with three detectors and no boundary.
| Control | Question it answers | Type | Example |
|---|---|---|---|
| Model evaluation | How did the model behave under testing? | Assurance evidence | Red-team benchmark, safety eval |
| Content detection | What is appearing in this session? | Deterministic and probabilistic detection | Schema validation (deterministic); injection or PII classifier (probabilistic) |
| Declared authorization | What may this agent do at all? | Deterministic policy | Destination and tool allowlist, limits |
| Containment | What happens after a violation? | Response | Session termination, quarantine |
Evaluation produces evidence about past behavior, detection observes the present, authorization decides in advance and deterministically what the agent is permitted to do, and containment enforces consequences when something crosses that line. A mature deployment runs all four. What a deployment must not do is ask detection to stand in for authorization; declared authorization is the one control whose job is to be deterministic and independently enforced.
Why detection cannot carry the boundary
Three structural reasons. First, semantic classifiers judging a model are themselves models, with failure modes an adversary can search for, and the adversary produces unlimited paraphrases; Cisco's assessment of eight open-weight models found multi-turn attack success rates two to ten times higher than single-turn attempts. Cisco tested jailbreak susceptibility rather than every detector, and the result illustrates the adaptive search problem faced by language-mediated controls generally. Second, the UK National Cyber Security Centre's December 2025 assessment concludes that prompt injection cannot be fully mitigated by any product or appliance, because an LLM enforces no internal boundary between instructions and data, and directs defenders toward safeguards outside the LLM that constrain what the system can do. Third, sometimes there is nothing to detect: CrowdStrike's DeepSeek-R1 findings showed ordinary, benign context degrading generated code security, the kind of detail no filter would or should block.
None of this argues against detection. Detection catches known attack patterns, flags sensitive content, and produces much of the evidence trail an investigation needs. The argument is about position: detection operates inside a deterministic authorization boundary and does not substitute for one. The difference is testable in an afternoon: rephrase the same prohibited objective across ten prompts. The classifier's verdict will vary across them; the destination-and-tool authorization decision will not.
What declared authorization requires
Four properties, testable in any platform. The declaration exists as an explicit, versioned artifact a security team can review, covering destinations, tools, data classes, actions, rate and volume limits, and the actions reserved for a human decision, not as intentions scattered across system prompts. Enforcement runs outside the agent's process and outside its write control, at an endpoint network layer, a kernel-enforced boundary, or an external session chokepoint, so a modified or compromised agent that declines to cooperate changes nothing. The default is deny: an unrecognized destination or tool call is blocked, not risk-scored. And decisions are deterministic: the same request, under the same identity, project, and policy version, gets the same answer every time, which is what makes the audit trail meaningful and the policy testable.
One honesty requirement: the enforcement point must match the capability. Network and session chokepoints govern destinations, model and tool calls, and credentials; local file access and command execution need OS, container, or process-level controls.
The payoff is a finite governance task
Declaring intent does not remove human work; it relocates it. Instead of reviewing an unbounded space of model behaviors, the governance task becomes reviewing a bounded list of declared permissions. That review is real effort. It is also the first governance task in this domain that is actually finite.
Where the control plane fits
Ensage AI enforces declared authorization at layers the agent cannot bypass, with the AI Session Controller on the session path and enclave reachability beneath it, while session inspection runs as defense in depth inside that boundary.
