1
Indirect prompt injection
A malicious document parsed by the agent contains hidden instructions that hijack it from its task.
Agentic security
Securing an agent swarm that touches your production.
Zero Standing Privilege, Just-In-Time access, reverse offensive audit, 'data stays client-side' doctrine. The Access agentic security framework — for banking, insurance, healthcare, public sector, and all regulated contexts.
The paradox
An autonomous agent is a risk no human has ever been.
An agent swarm reading your mailbox, parsing your files, writing to your ERP, and running code in your cloud — that is a new actor in your security perimeter. Four classes of risks specific to agentic systems emerge and require a dedicated framework.
2
Data extraction via side channel
The agent exfiltrates sensitive data through logs, file names, variable names, or message length.
3
Silent code or configuration modification
The agent alters a critical file without triggering alerts if classical controls aren't adapted.
4
Audit log tampering or deletion
The agent, by bug or maliciously, hides its own traces in logs.
The 4 Access pillars
The Access agentic security framework.
01
Zero Standing Privilege (ZSP)
PrincipleNo agent has permanent rights on your systems. No persistent credentials, no long-lived API keys, no service account shared between agents.
Implementation
- ▸Every permission requested from a rights orchestrator, justified by the agent (reason, duration, scope)
- ▸Right granted per session, automatically revoked at session end
- ▸No elevation possible without explicit policy validation
BenefitEliminates the entire class of risks tied to compromised credentials — the attacker finds no reusable token to steal.
02
Just-In-Time access (JIT)
PrincipleConcrete mechanism enforcing ZSP. The access key lives only as long as strictly necessary for the operation, then self-destructs.
Implementation
- ▸On-demand key generation per business operation
- ▸Configurable lifespan (typically 30 seconds to a few hours)
- ▸Full audit of every generation, use, and expiration
BenefitAn attacker intercepting a key has minutes at most, not days.
03
Reverse offensive audit
PrincipleAttacking agents continuously probe the perimeter of defensive agents. Inverts the classical one-shot pentest logic into a permanent and large-scale mode.
Implementation
- ▸Auditor agent swarm in a sandbox representative of production
- ▸Continuous attack generation (prompt injection, data exfiltration, privilege escalation)
- ▸Automatic anomaly detection
- ▸Weekly CISO report with proposed patches
BenefitZero-day vulnerabilities are detected before exploitation.
04
Multi-tenancy isolation
PrincipleZero context mixing across clients or entities. Even if the same swarm serves multiple subsidiaries, each session is logically and auditably isolated.
Implementation
- ▸Vector stores, conversational memory, prompts and logs separated per tenant
- ▸Automated cross-tenant leakage controls on every PR and deployment
- ▸Confidential Computing (TEE) for the most sensitive tenants
- ▸Per-tenant signed audit trail for compliance demonstration
BenefitDemonstrable to DPO, CISO, external auditor. Non-negotiable prerequisite for banking / insurance / healthcare.
Doctrine
Sensitive data never leaves your perimeter.
Doctrine shared with our ServiceNow ITSM nearshore offering — it applies fully to agentic: the architecture adapts to the data sensitivity level, not the other way around.
Sensitivity levelRecommended Access architecture
Public or low-sensitivity data
Public cloud LLM (Claude API, GPT API, Mistral La Plateforme), nearshore Tunis.
Standard GDPR client data
Public cloud LLM with GDPR-compliant DPA, Vivantro France swarm hosting.
Regulated data (banking, insurance, healthcare)
Sovereign LLM (Mistral on-premise or open-weight models) + Confidential Computing + sovereign hosting.
Defence / classified data
Open-weight LLM deployed on-premise client + zero network egress.
Compliance covered
Access swarms operate in compliance with.
GDPR
European Union — standard DPA, processing register, data subject rights integrated by design.
KSA PDPL
Saudi Arabia — regional hosting, framed transfers, explicit consent.
HIPAA
United States — healthcare. On specific configuration with appropriate hosting and BAA.
PCI-DSS
Payment — systematic PAN tokenization before agent ingestion.
Law 25
Quebec — local GDPR equivalent.
NIS2
European Union — 24h incident notification, cyber risk management, regular audits.
AI Act
European Union — high-risk AI system classification, register, documentation, human supervision.
Note: Access does not claim certification on these frameworks — we operate in applicative compliance. Organization certifications (ISO 27001, HDS, etc.) must be completed by your CISO or auditor.
Regulated cases
Agentic security in action.
Banking — AML fraud detection
3-agent swarm scanning transactions 24/7 for AML patterns. ZSP on core banking access. JIT per analyzed transaction. Reverse offensive audit to validate robustness against adversarial attacks.
Insurance — Claim instruction
Swarm pre-instructing claim files: PDF extraction, normalization, contract cross-checking. Client data isolated per tenant. Auditable multi-tenancy isolation for ACPR demonstration.
Healthcare — Appointment & patient journey management
Multi-specialty appointment coordination swarm. On-premise sovereign LLM, zero patient data leaving. HDS hosting compliance upstream, agent applicative compliance downstream.
Public sector — Citizen file instruction
Administrative file instruction swarm. Strict per-file isolation, full audit trail for the control authority, selective supervision by human instructor on contested cases.
Frequently asked questions
Agentic security — what CISOs ask.
Does ZSP work with swarms that need persistent state between sessions?+
Yes. Persistent state (conversational memory, vector store, audit trail) is stored separately from access permissions. The agent recovers its state at session start, but without permanent privilege on downstream systems.
Does Confidential Computing add latency?+
Yes, marginally (5-20 % typically depending on load). For cases where latency trumps radical confidentiality (e.g. a public conversational swarm), we recommend a standard architecture. For sensitive cases, the latency cost is acceptable.
Who is responsible if the swarm makes a bad decision?+
Selective supervision puts the human in validation of critical decisions. For routine decisions executed autonomously, responsibility is contractually framed: business guardrails signed by the client, observed-behavior register, remediation plan. Every contestable decision is tracked and reviewed.
How does Access handle LLM model updates?+
Mandatory quarterly recertification policy: at every major update of a used LLM, the swarm is revalidated on the reference test set. If the agreement rate drops, the swarm falls back to degraded mode (humans only) until corrected.
What happens if the LLM provider has an outage?+
Pre-wired degraded mode architecture. Automatic switch to secondary LLM (vendor-neutral allows this), or fallback to humans only if no compatible LLM is available. SLA defined with the client at E1 Intake.
Can the prompts sent to the LLM by the agent be audited?+
Yes. Every agent → LLM prompt is logged with signed timestamp, origin context, session ID, and hash of received output. Full audit exportable in standard SIEM format.
Can reverse offensive audit cause damage in production?+
No, by design. Offensive audit runs in an isolated sandbox environment isomorphic to production, never on production directly. Identified patches are proposed to the client CISO for controlled application.
What is the recertification frequency?+
Mandatory quarterly (4 times per year minimum). Additional event-driven recertification on: major LLM update used, impacting regulatory change, material security incident.
Scope an agentic security audit.
3 weeks of scoping with your CISO to assess your organization's agentic security maturity and define the industrialization plan.