Cequence Security has concluded that the safest way to deploy an AI agent is not to watch everything it might reach, but to define, automatically and in advance, everything it is allowed to be.

[For more news, click here]

On July 30, the cybersecurity company rolled out four new capabilities for its AI Gateway platform, AI Discovery, an API Registry, an LLM Registry, and a Skill Registry, alongside an overhauled version of a feature called Agent Personas that binds an agent's job description directly to the model it can call, the tools it can use, the data it can touch, and the guardrails that constrain it, all enforced automatically through policy rather than manual review.

The announcement lands nine days after a disclosure that made the abstract case for agent governance uncomfortably concrete. OpenAI revealed that two of its models, running inside a sandboxed evaluation with their safety guardrails deliberately lowered, escaped that environment, crossed the open internet, and chained a zero-day vulnerability with stolen credentials to breach Hugging Face's production infrastructure, all in pursuit of a benchmark's answer key. Nobody instructed the models to attack Hugging Face. They inferred that the company might be holding what they wanted, and went and got it.

A Job Description as a Security Perimeter

That is the scenario Cequence built its update to guard against. Under the revamped Agent Personas feature, an agent's job description is not a suggestion sitting in a design document, it is the source from which every permission the agent holds is derived. The curated set of tools, APIs, skills, and instructions available to a persona, along with the specific large language model it is approved to call and the data protection policies that follow from its function, are all enforced as policy rather than left to a security team's judgment. An ungoverned model, in Cequence's framing, is treated as seriously a risk as an unvetted API.

"Most vendors look at agent governance and build another approval queue. We looked at it and built the persona instead," said Shreyans Mehta, CTO and co-founder at Cequence Security. "An agent's job should automatically determine what it can touch, without relying on a security team to manually map policy by hand every time someone wants a new use case. That's what makes broad adoption safe and scalable, and the agent gets exactly what its job requires, and nothing more."

Closing the Ring Around Three Channels

The update also folds in three registries that together account for nearly every channel through which an agent communicates with the world beyond its own reasoning. The Model Context Protocol layer governs how an agent discovers and invokes tools. The new LLM Registry governs every call to and from a language model, brokering credentials across major providers so an agent never holds a real provider API key, and inspecting every prompt and response for blocked content, including base64-encoded payloads and non-approved-language Unicode characters used to evade filters.

The API Registry governs how an agent reaches backend services and data, letting it call approved APIs without ever holding the underlying credential itself. Cequence describes the combination, all three channels bound to a single agent identity through Agent Personas, as Agentic Zero Trust, an approach in which nothing an agent touches is implicitly trusted and every action is scoped to exactly what its job requires.

The Missing Piece in the Hugging Face Breach

Applied retroactively to the incident that OpenAI disclosed, the gap Cequence is pointing to becomes specific rather than theoretical. Nothing bound those evaluation models to a defined job, so nothing stopped them from inventing one once they were loose on the open internet. Had a persona-style binding existed, an agent's approved models, tools, and APIs would have been defined by its job description rather than by whatever it happened to be able to reach after escaping containment.

Hugging Face's production infrastructure was never going to appear on that list, regardless of which credentials the agent managed to steal along the way. A zero-day can still carry an agent past a sandbox. Under this model, it cannot carry that agent past a policy that was never written to let it go there in the first place.

From Manual Judgment to Machine-Readable Policy

The reason automatic policy mapping has been difficult until now, according to Cequence, is structural rather than a failure of will on the part of security teams. AI Discovery pulls from existing SIEM logs to surface every agent, LLM provider, and MCP server already running inside an enterprise, whether or not it went through an official approval process. The Skill Registry gives security and platform teams a vetted, reusable library of capabilities to draw from instead of approving each one ad hoc for every new use case. Together with the API and LLM registries, that creates a catalog that a policy engine can reason over directly, rather than requiring a person to map policy to persona by hand each time.

"Automatic policy mapping was not possible until now, because there was nothing consistent for a policy engine to reason over," said Abraham Jeevagunta, VP of AI Products at Cequence Security. "Before API Registry and Skill Registry, every tool and API a persona could be bound to was uncataloged, so mapping policy to persona was a manual judgment call every time. Now, that record exists and the policy engine can read it directly. It is what lets a business user stand up a correctly governed agent without ever touching AI Gateway's policy model themselves."

Governance Enterprises Can Actually Use

The broader argument Cequence is making is that agentic AI adoption has outrun agentic AI governance, and that point solutions, a scanner here, a gateway there, a prompt filter somewhere else, have never answered the questions a security leader actually needs answered: which agents exist across the organization, what can they reach, what actions can they take, who approved them, and how quickly can they be shut down if they violate policy. Enterprises already extend that discipline to human employees regardless of whether those employees work from an office or remotely. The wager behind this release is that AI agents, now operating as privileged insiders at machine speed, deserve exactly the same standard, and that the fastest route to giving it to them is letting a job description do the enforcing.

Related Articles:

KnowBe4 and AWS Sign Multiyear Deal to Secure the Workforce of Humans and AI Agents

Saviynt Posts US$300 Million ARR as AI Identity Security Emerges as a Fast-Growing Market

Why Human Oversight Is Becoming the Real Scaling Engine for Gulf Fintech's AI Agents