Three Pillars of Securing AI Agents in Production
I spent years in network engineering before I moved into AI, so when people ask me how to secure an AI agent, my first question is: what’s so different? Every AI system, whether it’s a chatbot, a RAG pipeline, or an agent calling MCP servers in a loop, comes down to the same four things. An identity, on a device, acting as an app, touching data over a network.
That communication flow is something we’ve been securing for 30 years. What changed is that the app is no longer deterministic. And with the improvements in large language models, vulnerability discovery went from months to minutes. The mistakes we used to have time to fix now get found first. The good news is that the controls you already know still apply. You just need more of them, and you need to know where they go.
Three pillars
When you hear about AI security, two topics come up. An isolated sandbox for your agents, usually Docker, and guardrails on the model’s inputs and outputs. Both are a great start, but there is a lot more to think about. Let’s break it down into three pillars.
Pillar 1: Secure against AI
Agents are not just things you build. They are now showing up at your website’s front door. From customers’ assistants reading your page, to web scrapers, to attackers. When an AI agent breaks into an environment, it usually doesn’t need any AI specific tools to do it. It finds ordinary web application vulnerabilities, gets valid tokens, and then moves laterally in your organization like any other attacker, just faster. An environment with zero AI workloads is still a target, and basic defense in depth is what stops it.
So the first pillar starts where attackers start, with reconnaissance. Know what your business looks like from the outside. There is always something forgotten, and it’s usually an API, not a model.
Pillar 2: Secure the AI
Now let’s turn this around. This time the agent is yours, running in your backend. Think of the agent core as the center of the system. This is the agentic loop. The agent reads the input, calls the model, calls the tools, updates memory, and repeat until the goal is achieved. Everything the agent depends on sits outside of that loop, and that’s where you put your controls.
The way to do that is with two gateways. The first sits in front of the agent and handles everything that calls it, whether that’s a user in a chat window or another agent. The second sits behind the agent and handles everything it reaches out to like the model, the tools, and the memory. A year ago these would have been plain API gateways. Today they handle MCP and inference traffic on top of identity, rate limiting, and runtime controls.
In production you may not control the model. It might be a frontier lab’s API or something you host yourself. You may not control every tool. But you do control the harness, and the harness is the control plane. That’s where the tightest guardrails go. This where you protect what comes in, what goes out, and what the agent is allowed to do.
Pillar 3: Secure with AI
The third pillar is your own teams, and it’s the hardest one because the agent lives on the endpoint. Claude Code, Copilot, Codex, and the rest run on developer laptops. They install their own MCP servers, they read and write files, and they act with the developer’s credentials. Everything the developer can reach, the agent can reach. This is where shadow AI comes from. For example, a developer’s enterprise token limit runs out, so they log into a free personal AI account to finish the job. In their mind they’re just getting the job done, but your company’s code just left the building, and now you have an incident.
This scenario has two surfaces. The first one is the browser. When someone opens a free ChatGPT account instead of the enterprise one, don’t block them. Redirect them to the right internal login. That turns security from the team that says no into the team that shows you the right door. The second is the desktop. Most coding agents now expose hooks, which are a way to inject into or check what’s happening in the agent loop. Capture those hooks and tie them to your policy. This gives you visibility into what agents are running and what they’re trying to do. Akamai does both.
Where to start
When determining where to start. Start with four questions. Which identity is the agent using? Which device is it running on? What data can it access? And over which networks? If you can’t answer those four questions for every agent in your environment, then no added AI control is going to save you.
Once you have that, work from the outside in. Determine your agent’s exposure and your infrastructure’s exposure. Put the edge controls in place. Get API security covering the calls your agents make. Secure the agent’s harness. Then deal with the endpoint last, because that’s the hardest part.
Conclusion
Most of this framework comes from a conversation I had with Bogdan Carstea, Sr. Enterprise Security Architect at Akamai. The three pillars and the agent harness diagram are his. We also got into whether platform engineering is the real fix for shadow AI, and a customer running coding agents and models entirely on their own cloud.
Check out the full interview on the Akamai Developers channel:
peace,