Secure
Governance, agent oversight, shadow AI, cost accountability, and compliance evidence. What are the agents up to, and can you prove it?
Secure is the part of the surface concerned with answering for the system: what it is permitted to do, what it actually did, what it cost, and whether you can show any of that to somebody who was not there.
It is the letter most often treated as a phase rather than a property. Something gets built, it works, and then security and compliance are asked to bless it, which is the point at which everyone discovers that the necessary records were never produced.
The claim
Secure is not a subset of the other four letters and it is not a review gate at the end. It is a set of standing requirements that change what the other four have to emit.
Three of them are genuinely different from pre-AI security work:
Untrusted content is an instruction channel. Every document, ticket, and email an assistant reads can carry instructions to it. The perimeter model assumed data moves when a person moves it; an agent moves data continuously as a side effect of working. See agents.
The blast radius is the union of standing access. For a conventional service you reason about what a request can do. For an agent you have to reason about everything its tools and identity can reach, which is usually larger than anyone intended.
Spend is a security control. An agent in a loop is a financial incident, and the control that stops it is a quota rather than a policy. See cost.
The tests that matter
- Blast radius. For your most autonomous agent, list its tools, identity, data reach, egress, and cost ceiling. Can anyone produce that today?
- Shadow. Pull six months of expense reports. What AI subscriptions are on personal cards?
- Evidence. Could you answer an auditor’s access and change questions for last quarter with a query rather than an investigation?
The tension
Secure pulls against every other letter, and the resolution is always the same: the controls that get used are the ones inherited from a fast path, and the controls that get routed around are the ones implemented as queues. A ban is the extreme case. It moves the activity somewhere you cannot see rather than stopping it, which is why shadow AI is a Secure problem with a Build solution.
Secure hands back to Build: what you learn here changes what you are willing to let people make, and how quickly.
In this part of the surface
- Governance: Policy encoded where it is enforced, not written where it is filed.
- Agents: What are the agents up to: tool permissions, audit trails, and human oversight that survives contact with volume.
- Shadow AI: Discovering unsanctioned tools, and understanding why people reached for them in the first place.
- Cost: FinOps for AI: who spends what on which model, and why monthly reporting is too slow to be a control.
- Compliance: HIPAA, SOC 2, PCI, FedRAMP, and the EU AI Act: audit evidence as a platform output rather than a quarterly scramble.