Secure AI agents need controls outside the model

The useful lesson

NVIDIA's AI Red Team makes a simple point that matches Burhuc's direction: agent security cannot rely only on prompt instructions, model self-policing, or another model judging the output. The boundary has to sit outside the model too.

That matters because an AI agent can call tools, read files, write memory, install packages, use credentials, or reach the network. Once those capabilities exist, the security question is not only whether the model refused the bad prompt. It is also whether the runtime could stop the action even if the model tried.

Four controls to make deterministic

• Access control: bind every action to a user, tenant, role, and allowed purpose before the agent can act.
• Execution limits: restrict commands, package installs, repository access, writable paths, and tool calls outside the prompt.
• Default-deny egress: block outbound network access unless the destination is explicitly allowed and logged.
• Secrets outside the agent: keep credentials out of the agent runtime and broker short-lived scoped tokens only when needed.

How Burhuc will use it

For CertentIQ, this becomes a test target. Evaluations should probe unauthorized tool use, tenant-boundary bypass, arbitrary package installation, memory or configuration mutation, secret extraction, and outbound exfiltration. The result remains run-specific evidence, not a blanket guarantee.

For CertentiWall, this becomes product direction. CertentiWall should be the deterministic control layer around agent effects: identity checks, scoped tools, controlled memory and file writes, egress policy, secret brokering, and action evidence.

For CertentiTrain, this becomes remediation material. If an agent fails one of these boundaries, the remediation candidate should not only improve wording. It should change the surrounding control surface where the risk actually lives.

What this is not

This is not an independent security certification and not a claim that every Burhuc agent surface already implements every control. It is a baseline for design, testing, and release review. Public claims should stay tied to the controls actually implemented and the evidence actually recorded.

Source: NVIDIA Technical Blog - NVIDIA AI Red Team guidance on access control, code execution limits, default-deny network egress, secrets handling, and deterministic controls.