Why agentic security splits into three architectural lanes
When teams talk about "AI security" as a single monolith, they mix together runtime prompt injection, SOC alert triage automation, and autonomous coding assistants opening pull requests. At Meridian Space & Robotics (chronos.orbital), Principal Security Architect Vera Vance separates agentic engineering into three distinct lanes based on who invokes the agent, what data it reads, and what state changes it can propose.
First, AI Application & Agent Security (G1–G3) governs customer-facing and internal tool-calling agents where untrusted text and retrieval chunks meet deterministic Policy Enforcement Points (PEPs) and human approval gates. Second, Agentic SOC (S4) governs security operations assistants that enrich alerts and draft investigation timelines while human analysts retain authority over destructive containment. Third, Agentic SDLC & Tool Identity (A3a–A3b) governs coding agents in the build pipeline and On-Behalf-Of (RFC 8693) delegation when agents call internal APIs.
Ordered lessons across the three agentic lanes
Start in the AI Application & Agent Security path: [Prompt injection and retrieval (G1)](Prompt injection and untrusted retrieval (RAG): when data hijacks instructions) establishes why user input, RAG chunks, and tool outputs belong on the untrusted data plane; [Excessive agency (G2)](Excessive agency: why a model sentence is never an authorization decision) places a deterministic authorization gate between model output and tool execution; and [Human oversight gates (G3)](Human oversight gates and the NIST AI Risk Management Framework) wires out-of-band human sign-off and NIST AI RMF (GOVERN, MAP, MEASURE, MANAGE) around high-impact actions.
Next, explore Operations and SDLC: [Agentic SOC (S4)](Agentic SOC architecture: autonomous triage vs human-gated containment) applies those boundaries to incident response inside the Security Operations Center; [Agentic SDLC security (A3a)](Agentic SDLC security: coding assistants, autonomous PRs, and build gates) keeps coding assistants on the untrusted authoring side of CI/CD review gates; and [Agent tool identity (A3b)](Agent tool identity: On-Behalf-Of delegation vs ambient service keys) replaces ambient service keys with OAuth 2.0 Token Exchange so every tool call preserves both the human principal (sub) and the agent actor (act).
The unifying invariant across every lane
Across all six lessons, one architectural invariant never changes: a probabilistic model token stream is an untrusted proposal, never an authentication proof, an authorization policy, or a self-approving code reviewer. Keep credentials, policy enforcement, and cryptographic provenance in deterministic code outside the model context window.