There are two words that have defined the experience of enterprise security for fifty years, and they've taught every employee the same corrosive lesson. Access denied. No explanation, no recourse except a help-desk ticket, no acknowledgment that you might have a perfectly good reason. The message behind the message: security is a wall, and you are on the wrong side of it.
I've come to believe those two words are ending — not because security is loosening, but because the binary they represent was always a design failure, and the AI era has finally made that failure expensive enough to fix.
From verdicts to conversations
The insight is almost embarrassingly simple: between "yes" and "no" lives an entire spectrum of "convince me." When an access request looks ambiguous — right person, odd document; legitimate role, unusual volume — the intelligent response isn't a verdict at all. It's a challenge: a targeted request for exactly the missing context. Explain why you need this file — checked, in real time, against what the document actually contains. Touch your security key — proving a present human, not a stolen session. Request approval from the data's owner — routing the decision to the person actually equipped to make it. Take a selfie check — confirming the administrator performing a dangerous operation is physically at their machine, not a buyer of their credentials.
Notice what each challenge does: it converts an ambiguous situation into an informed decision without defaulting to refusal. For the legitimate user, a fifteen-second interaction replaces a lost afternoon of tickets. For the attacker holding stolen credentials, the same challenge is a wall that arrives with an audit trail attached — legitimacy is cheap to prove when real and expensive to fake. Where suspicion is stronger, challenges harden into containments — durable restrictions that don't vanish on one correct password, and that may lift only after a human conversation. The system's posture scales with evidence, in both directions.
And here's the underrated half: the same machinery that adds friction subtracts it. The engineer showing up from the same device, same location, same working hours, doing exactly what their role predicts? Skip the ritual re-authentication — until the day behavior drifts, when it quietly returns. Traditional security spent friction uniformly, like a tax; adaptive security spends it precisely, like evidence-based medicine. Attackers should experience more resistance and legitimate users less. Any system delivering only one half is doing it wrong. Security stops being a wall and becomes a conversation — one that most employees, most days, never notice they're having.
The intent question nobody's infrastructure can answer
Now add agents, because they're what forces this evolution from nice-to-have to necessary. When an AI agent reaches for a resource, the old question — is this identity authorized? — is no longer even the interesting one. The interesting questions are: What is this agent trying to accomplish? Is that what its human actually asked for? And is that aligned with what policy permits?
Three intents, which can disagree — and the daylight between them is precisely where the new attacks live. Prompt injection is, at bottom, an intent-hijacking attack: the user's purpose says one thing, a poisoned input redirects the agent's effective purpose toward another, and classical authorization is structurally blind to the swap because the credentials never stopped being valid. A security layer that can compare user intent, agent intent, and policy intent — and challenge when they diverge ("your agent is attempting X; did you intend that?") — is the difference between delegation you can trust and delegation you merely hope about. The confirmation prompt to the controlling human turns out to be the humble hero of agentic security: rogue behavior, caught not by parsing model internals but by asking the person.
The plumbing that doesn't exist yet
Here's the honest catch: almost none of today's infrastructure can even express these questions. Three gaps stand out, and they're ecosystem-shaped, not product-shaped.
Attribution. When an agent acts, today's logs typically show a bare service account or a borrowed user credential. The primitive we need is a standard annotation on every agent action naming three things: which agent, on behalf of which human, for which task. Without that triple, per-task scoping, intent checking, and honest audit are all impossible — you cannot secure what you cannot attribute.
Introspection. Judging whether an agent's behavior matches its assignment requires visibility into its reasoning and tool use — standardized, real-time interfaces for examining what an agent is doing and why, not proprietary afterthoughts scraped from vendor logs.
Pluggable policy. The enterprise's own reasoning engine has to sit in the decision path of every system its people and agents touch — which means SaaS products treating externally operated policy evaluation as a first-class integration, not an enterprise-tier curiosity. My access brain is useless if your product won't let it see the decisions.
None of these is buildable by one vendor alone; they're standards problems, and the standards conversation — including early government-level attention to agent security — is just beginning. If you're a builder, this is the rare moment where the interesting problems are still unclaimed. If you're a buyer, add these to your diligence now: How are your agents' actions attributed? Can I inspect their tool use? Will your product enforce my policy engine's decisions? Vendors respond to questions asked at contract time with a speed no standards body can match.
Fifty years of "access denied" trained us to accept that security and usability trade off linearly — more of one, less of the other. The conversational model breaks the trade: friction concentrated where evidence demands it, removed where it doesn't, and a new vocabulary — challenge, justify, confirm, contain — replacing the binary that served neither side well. The wall had a good run. What replaces it doesn't just block better. It listens.
