Secure AI agents by their traits, not their labels

The Cloud Security Alliance argues that agentic systems should be secured according to how they behave, not according to a broad label such as assistant, supervisor, or multi-agent platform. Each architectural choice creates different failure modes, so security analysis must follow the traits actually present in the system.

CISSP Domain 3, Security Architecture and Engineering, is the primary lens. Centralized control may simplify policy but create a critical point of failure. Decentralized coordination may improve resilience while making authorization and consistency harder. Reactive and plan-based agents introduce different manipulation opportunities. The paper applies familiar principles - least privilege, defense in depth, secure defaults, and continuous verification - to systems whose actions are adaptive rather than deterministic.

Domain 4, Communication and Network Security, matters because agents exchange instructions, context, state, and results across services and trust boundaries. Direct and indirect communication patterns need authenticated channels, integrity protection, segmentation, monitoring, and limits on which messages can influence decisions.

Domain 5, Identity and Access Management, becomes especially important when agents call tools. Designers must distinguish an agent's service identity from a user's delegated authority, constrain credentials, verify requests, and avoid allowing broad permissions to travel through an autonomous workflow. Trust must be transactional and continuously evaluated, not inherited merely because one component is inside a boundary.

Domain 8, Software Development Security, turns trait analysis into design reviews and threat models before deployment. Teams can document the traits selected, identify associated risks, choose patterns and mitigations, and revisit the analysis as capabilities change.

My takeaway is that agent security begins with an honest architecture description. If a team cannot explain how control, communication, identity, trust, and tools work, it cannot meaningfully assess the risks. Trait-based analysis provides a practical vocabulary for making those assumptions visible before autonomy turns them into production incidents.