Back to Case Studies
Securing AI Agents for Production - Chris Rasco, Head of AI/ML Platforms
A conversation with the Head of AI/ML Platforms at an Atlanta-based financial services company, following an early look at Britive ARC™ (Agentic Runtime Control). The views here are his own, shared as a practitioner working through how to move AI agents into production safely.
The Shift
Employees now manage virtual teams of agents
The Gap
Agents act without autonomy or judgment
The Control
Task-scoped access, nothing standing between tasks.
The Permission Problem Behind the AI Workforce
Enterprises adopting agentic AI are not adding tools. They are adding workers. Alongside teams of people, employees increasingly have virtual teams of AI agents that query databases, call APIs, change infrastructure, and act on problems surfaced by other agents. That shift breaks an assumption the access model has always quietly depended on. Permissions on a human team were never symmetrical, and were never meant to be.
'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_656_3085'%20x1='0.51282'%20y1='0.726496'%20x2='11.8307'%20y2='6.25757'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%23CA1ECC'/%3e%3cstop%20offset='1'%20stop-color='%233E5DE0'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e)
“I’ve got people that work for me, with permissions to go do things in systems, and it’s different for each person. Those permissions can be completely different from what I have — and they should be, because I hired that person to perform a series of tasks. It’s not work I perform myself. The permissions are asymmetric, and they differ across the entire team.”
What holds that model together is not the permission structure. It is the person. A human being exercises judgment about when to use access, when to stop, and when something looks wrong. The access is bounded by the entitlement, but it is governed by the human.
“With a physical team of people, their ability to make decisions and use that access is governed basically by the fact that they are humans — they have human autonomy. When you turn it into a virtual team, the problem changes. Agents do not have autonomy. They have autonomy only in the sense that I told them what to do, and all they ever do is what I told them to do. They do not have free will. They cannot act and they cannot make decisions outside of that.”
Whatever access an agent holds, it will use exactly as instructed, at machine speed — including when the instruction is wrong. That leaves a question most organizations have not answered.
“If I have ten agents instead of ten people, should those agents have permissions that are a subset of what I have, or a differing superset? The foundational problem is that question of differing permissions between a team of humans and a team of non-humans, relative to myself as the manager.”
Key issues include:
'/%3e%3cpath%20d='M5.42857%2016.2H10.8571V21.6H5.42857V16.2Z'%20fill='url(%23paint1_linear_1_1466)'/%3e%3cpath%20d='M10.8571%2021.6H16.2857V27H10.8571V21.6Z'%20fill='url(%23paint2_linear_1_1466)'/%3e%3cpath%20d='M16.2857%2016.2H21.7143V21.6H16.2857V16.2Z'%20fill='url(%23paint3_linear_1_1466)'/%3e%3cpath%20d='M21.7143%2010.8H27.1429V16.2H21.7143V10.8Z'%20fill='url(%23paint4_linear_1_1466)'/%3e%3cpath%20d='M27.1429%205.4H32.5714V10.8H27.1429V5.4Z'%20fill='url(%23paint5_linear_1_1466)'/%3e%3cpath%20d='M32.5714%200H38V5.4H32.5714V0Z'%20fill='url(%23paint6_linear_1_1466)'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_1_1466'%20x1='1.94872'%20y1='1.96154'%20x2='38.1177'%20y2='26.8387'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%23CA1ECC'/%3e%3cstop%20offset='1'%20stop-color='%233E5DE0'/%3e%3c/linearGradient%3e%3clinearGradient%20id='paint1_linear_1_1466'%20x1='1.94872'%20y1='1.96154'%20x2='38.1177'%20y2='26.8387'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%23CA1ECC'/%3e%3cstop%20offset='1'%20stop-color='%233E5DE0'/%3e%3c/linearGradient%3e%3clinearGradient%20id='paint2_linear_1_1466'%20x1='1.94872'%20y1='1.96154'%20x2='38.1177'%20y2='26.8387'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%23CA1ECC'/%3e%3cstop%20offset='1'%20stop-color='%233E5DE0'/%3e%3c/linearGradient%3e%3clinearGradient%20id='paint3_linear_1_1466'%20x1='1.94872'%20y1='1.96154'%20x2='38.1177'%20y2='26.8387'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%23CA1ECC'/%3e%3cstop%20offset='1'%20stop-color='%233E5DE0'/%3e%3c/linearGradient%3e%3clinearGradient%20id='paint4_linear_1_1466'%20x1='1.94872'%20y1='1.96154'%20x2='38.1177'%20y2='26.8387'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%23CA1ECC'/%3e%3cstop%20offset='1'%20stop-color='%233E5DE0'/%3e%3c/linearGradient%3e%3clinearGradient%20id='paint5_linear_1_1466'%20x1='1.94872'%20y1='1.96154'%20x2='38.1177'%20y2='26.8387'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%23CA1ECC'/%3e%3cstop%20offset='1'%20stop-color='%233E5DE0'/%3e%3c/linearGradient%3e%3clinearGradient%20id='paint6_linear_1_1466'%20x1='1.94872'%20y1='1.96154'%20x2='38.1177'%20y2='26.8387'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%23CA1ECC'/%3e%3cstop%20offset='1'%20stop-color='%233E5DE0'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
Judgment is no longer part of the control: The unwritten safeguard on human privilege was the person exercising it. Agents execute instructions without evaluating whether they should.
Authority is set once, then held indefinitely: Agents are typically issued a service account and a scope broad enough to cover every task they might perform, with the access persisting between tasks.
The subset-or-superset question goes unanswered: Without a deliberate model, an agent's authority relative to the person it works for is decided by whatever was provisioned rather than by policy.
Standing privilege scales with the agent population: Risk that was already difficult to accept for human engineers compounds as every employee begins building agents.
Agent access is governed apart from everything else: Managing agents through a separate control plane creates a second policy model, a second audit trail, and a second place to look when something goes wrong.
Britive's Solution
Britive ARC™ ties access to the work being performed rather than to the identity performing it. Each grant is evaluated in context — the identity behind the request, the task, and the scope that task requires. Authority appears when the work requires it, stays under control while the work runs, and is removed when the task is complete
Task-Scoped Access at Runtime — Agents hold no privileged access between tasks. Privilege can be elevated directly inside the target system without issuing the agent a credential to keep. Where credentials are required, they can be created at runtime and revoked when the task ends.
Authority Bounded by the Delegating Identity — When an agent acts on behalf of a person, its authority can be held at or below that person's authority, then narrowed further to the privileges permitted for that agent, for a specific task, resource, or content. The delegating identity and the agent stay connected throughout the transaction and the audit record.
Control That Continues After Access Is Granted — Through the Britive MCP Gateway, agent tool calls are evaluated against centralized policy at runtime before unauthorized actions reach downstream systems. Shared Signals Framework events, including CAEP and RISC, can trigger additional enforcement or revoke an active session as conditions change.
One Platform for Every Identity Type — Agentic AI comes under the same runtime policy and enforcement platform already used for human and non-human identities across hybrid, multi-cloud, SaaS, database, server, and on-premises environments.
“What I saw was the ability to manage access and permissions for the non-humans in a just-in-time fashion, so they’re not standing. There’s zero standing access. They check out the credentials they need, scoped to the task bestowed upon them and nothing more, plus any auxiliary access they need. The agents are only able to perform the actions we have scoped their permissions to. Foundationally, it’s just-intime access — but for your non-human identities.”
Because agents act for people, interact with machine identities, and reach systems already governed by enterprise access policy, keeping them on the same platform matters as much as the enforcement model itself.
“You get that same view of just-in-time access, but it’s all reported and contained in a platform that already has your human access — for hybrid, for multi-cloud, and if you’re using the broker capabilities, all your entitlements, all your identities, everything is managed in a single platform, all done checkout, check-in. That’s what I saw: the power to solve the agentic identity piece.”
What Enterprises Gain by Securing Agents at Runtime
Zero Standing Privilege for Agents: Access is created for the task and removed when the work is done, so there is no persistent agent credential to compromise, misuse, or expose.
A Deliberate Answer to the Authority Question: On-behalf-of delegation replaces provisioning by default, keeping agent authority at or below the human it acts for and narrowing it to the task.
Enforcement That Survives a Bad Instruction: An agent authorized to read from a database can still be stopped from performing an unauthorized destructive action, because tool calls are evaluated before they reach the resource.
Evidence Captured by Architecture: Every identity, request, authorization decision, privilege, action, and outcome is recorded as the transaction happens, rather than reconstructed afterward.
Consolidated Control Across Both Workforces: One policy model and one audit trail spanning human, non-human, and AI agent identities, instead of a separate control plane for agents.
Confidence to Move from Pilot to Production: Security stops being the reason agentic initiatives stall, and becomes the foundation that lets them ship.
“We were afraid to move forward because we didn’t know how to secure it. This checks a big box — it allows us to confidently say, okay, we’re going to go build some agents.”
What Comes Next?
Operationalizing this at enterprise scale is the next problem to solve. In an organization where thousands of employees are building agents, someone has to define and maintain the scoped profiles those agents check out — work required under any access model, and an area Britive continues to build toward making easier.
Get Started
View All CasesView All Cases
