The agentic enterprise needs an immune system

AI agents turn instructions into actions. Governing them therefore requires more than filtering what they say: we must limit what they can do, detect when they drift, and contain harm before it spreads.

Imagine an agent connected to email, the CRM, and billing. Its task is straightforward: read customer requests, draft responses, and process refunds within set limits. One morning it encounters a hidden instruction in an email telling it to ignore its rules, find sensitive information, and send it to an external address.

The model has not suddenly become malicious. The system has confused data with authority, and its tools have turned that confusion into operational power. This distinction matters. Traditional software exposes predefined routes through code. An agent chooses a route at runtime, often across several tools, based on context that may itself be hostile.

The governance problem is no longer merely whether a response is acceptable. It is whether an untrusted input can acquire the privileges of the agent, whether the agent can exceed its mandate, and whether the organization can reconstruct, stop, and reverse the resulting sequence.

From a system that answers to a system that acts

An agent combines a model with instructions, memory, tools, and a control loop. It can plan several steps, retrieve data, execute code, alter records, or coordinate with other agents. Open protocols such as Model Context Protocol (MCP) and Agent2Agent (A2A) make these connections easier: MCP standardizes access to tools and data; A2A supports communication between independent agents.

Those protocols are not vulnerabilities in themselves. Risk appears when systems are connected before the trust boundaries are resolved: who authenticates each actor, what authorizes each call, which data may cross the boundary, and what maximum impact a compromised credential can have.

The attack surface therefore extends beyond the prompt. It includes the tool catalogue, permissions, memory, external servers, service identities, network egress, and chains of agents that reuse an output without checking its origin. In other words, this is a harness engineering problem: everything built around a model to turn capability into a dependable, governable system.

Four ways to become ill

Agentic failures do not all share one cause. Lumping them together produces vague controls. At least four classes deserve separate treatment.

An immune system for the agentic enterprise

Biology provides a useful metaphor: an organism does not rely on a single wall. It combines barriers, distributed surveillance, rapid responses, memory, and adaptation. I call the disciplined use of this pattern in agentic security digital immune cybernetics.

It is not a standard, nor does it replace Zero Trust, identity management, secure development, or incident response. It is a way to organize those controls around one question: how does an organization detect, contain, and learn when one of its agents—or something the agent consumes—behaves like a threat?

The most important distinction is between detection and authorization. A second model can help classify an anomaly, but it should not have the final say over a transfer, deletion, or command to a physical system. Authority belongs in deterministic controls outside the model: access policies, spending limits, destination allowlists, separation of read and write, and safe operating states.

Guardrails still matter as defense in depth. A semantic filter may reduce known attacks, but it is not an infallible security boundary. If an injection gets through, least privilege, independent authorization, and isolation must still prevent an instruction from becoming a serious incident.

Human oversight does not disappear; it moves up a level

An analyst cannot approve every query, reasoning step, and API call in a high-volume system. Attempting to do so creates latency and approval fatigue: people eventually confirm decisions they no longer have time to evaluate. But removing human oversight is not the answer. Effective supervision is allocated by risk.

The machine supplies speed; the person defines authority.

The goal is not a human in every loop. It is a competent person who can understand, intervene, override, and remain accountable when it matters.

What changes in critical infrastructure

In banking, energy, healthcare, or logistics, a bad response does not end on a screen. It can move money, affect treatment, alter inventory, or touch a physical process. Here the immune metaphor is useful only when it becomes verifiable control.

Banking. A transactional agent should use approved beneficiaries, amount and frequency limits, its own credentials, and stronger authorization across thresholds. Anomaly detection may pause an operation; it should not replace deterministic settlement rules or approval for high-impact movement.

Energy and OT/SCADA. The agentic plane must remain separate from safety interlocks and deterministic control. With inconsistent data or lost confidence, it should degrade gracefully to a safe mode. NIST is developing an AI Risk Management Framework profile for critical infrastructure that emphasizes safe failure, adversarial robustness, and rigorous testing.

Healthcare. An assistant may summarize a record with restricted read access. Changing a prescription, sharing data, or executing a clinical decision requires another identity, domain validation, logging, and supervision proportional to risk.

Retail and supply chain. Agents may adjust inventory or prepare orders within authorized bands. Mass repricing, onboarding a supplier, or redirecting payments demands separate controls. Reversibility and economic impact—not the label “AI”—should determine autonomy.

Where the metaphor breaks

Every biological framework invites overreach. An immune system can attack healthy tissue, react too late, or cause more harm than the threat. Its digital equivalent blocks legitimate operations, revokes critical credentials, or isolates too many services after a false positive.

An agent that watches other agents may also share their weaknesses. If they all use the same model, memory, or provider, apparent diversity can hide a monoculture. And a system that “learns” automatically from every incident may learn from manipulated evidence.

Adaptation must therefore be governed. New signatures, evaluations, and policies require provenance, validation, versioning, ownership, and rollback. The metaphor becomes architecture only when each function has a control, metric, test, and owner.

Measuring immunity without pretending to be precise

The framework proposes two working instruments. FIT-Eval, summarized by a FIT-Score, describes an agent’s observable operational power along five dimensions: persistence of purpose, anticipatory capacity, autonomy in choosing actions, temporal commitment, and coherence between plan, traces, and behavior. It does not infer psychological “intent” or depend on private chains of thought; it measures what the system can do and what it actually does.

The second instrument is the Resilience Margin.

This is a proposed metric, not an industry standard. To be comparable, each term must be normalized and tied to observable measures: mean time to detect and contain, proportion of reversible actions, tools with write access, trace coverage, false-positive rate, stop-control effectiveness, and recovery time.

Direction matters more than a decimal. A system improves when it reduces the maximum harm an agent can cause while increasing its demonstrated ability to detect, contain, and recover.

Seven decisions to make now

1. Inventory every agent, its tools, credentials, data, owner, and possible actions.
2. Separate read from write with distinct tools and identities; remove permissions granted “just in case.”
3. Authorize outside the model every consequential action through deterministic policies and limits.
4. Record the complete trajectory: relevant context, version, tool calls, identity, result, approval, and override.
5. Evaluate attacks and failures before production, including indirect injection, tool abuse, repetition, recovery, and stopping.
6. Assign oversight by risk, reserving human approval for high-impact actions instead of symbolic gates everywhere.
7. Prepare containment and recovery with tested, reversible procedures and an owner empowered to stop the system.

The agentic enterprise does not need an unlimited fleet of agents watching one another. It needs an architecture in which no component—human, model, or tool—concentrates all trust.

That is the real value of immune thinking: moving from a defense that tries to prevent every failure to a system that limits exposure, recognizes signals, contains quickly, preserves memory, and improves without losing control.

Sources and method

This article presents digital immune cybernetics as a proposed framework and separates its hypotheses from established practice.

• OWASP — LLM01: Prompt Injection.
• OWASP — LLM06: Excessive Agency.
• MITRE ATLAS — threat matrix for AI systems.
• Model Context Protocol — Authorization.
• A2A Protocol — specification and security considerations.
• NIST — AI RMF Profile on Trustworthy AI in Critical Infrastructure.
• Kay Smarsly, Digital Immune Systems for Civil Infrastructure, IEEE Access, 2026.