PlainID Unveils Runtime Controls for Agentic AI Data Protection
Ai4
Gal Helemski argues static permissions fail to protect enterprise systems from autonomous agents, requiring real-time intent-based authorization across four distinct pipeline control points.
## Background
This video was published on YouTube by the channel Ai4 on August 14, 2026. Presented by Gal Helemski, Cofounder & Chief Product Officer of PlainID, the session focuses on setting security boundaries for agentic AI to prevent data exposure by applying centralized, runtime controls across enterprise workflows.
## TL;DR
Gal Helemski frames AI agents as a new class of autonomous, non-human employees that dynamically make reasoning decisions rather than following static, deterministic code. Because agents actively execute tasks and can exceed standard permission boundaries, traditional identity checks fail to capture whether an action is appropriate. To mitigate risks, Helemski introduces Intent-Based Access Control via Runtime Authorization, which continuously evaluates the context, identities involved, target assets, and process flows. The presentation details how to enforce these policy-driven guardrails across four crucial control points: input prompts, data pre-retrieval, MCP tool execution, and output redaction.
## Atmosphere & style
The presentation carries an authoritative, pragmatic, and insightful tone characteristic of a high-level enterprise security briefing. Helemski speaks with calm expertise, using clear visual analogies—such as airport security questioning—to break down complex identity architecture into digestible concepts. The narrative moves logically from establishing the emerging threat of non-human identities to delivering an actionable blueprint for runtime governance, creating an educational and forward-looking environment.
## Key takeaways
- [00:04](https://www.youtube.com/watch?v=VJN_6sKVf34&t=4s) Identity security has become the central challenge in agentic AI because agents act as autonomous entities taking direct actions rather than just retrieving information.
- [00:04](https://www.youtube.com/watch?v=VJN_6sKVf34&t=4s) Unlike traditional non-human identities, AI agents are designed to please the user and will actively push boundaries to fulfill a task.
- [02:30](https://www.youtube.com/watch?v=VJN_6sKVf34&t=150s) Identity verification and destination proof alone are insufficient for AI security; systems must evaluate the actor's real-time 'intent.'
- [04:15](https://www.youtube.com/watch?v=VJN_6sKVf34&t=255s) AI agents are non-deterministic and highly unpredictable compared to human users or standard linear service accounts, rendering static permission models obsolete.
- [06:18](https://www.youtube.com/watch?v=VJN_6sKVf34&t=378s) Intent-Based Access Control evaluates a combination of signals simultaneously: the human user, the active agent, target resources, and process context.
- [09:32](https://www.youtube.com/watch?v=VJN_6sKVf34&t=572s) Runtime authorization enforces policy-driven security boundaries continuously during execution, rather than through pre-assigned permissions or post-hoc auditing.
- [12:20](https://www.youtube.com/watch?v=VJN_6sKVf34&t=740s) Control Point 1 (Input Guardrails): Prompt controls must intercept and block unauthorized queries before backend resources or tools are engaged.
- [12:20](https://www.youtube.com/watch?v=VJN_6sKVf34&t=740s) Control Point 2 (Pre-Retrieval Guardrails): Context-based data filtering must occur before fetching records from structured databases or unstructured document stores.
- [12:20](https://www.youtube.com/watch?v=VJN_6sKVf34&t=740s) Control Point 3 (MCP Tool Guardrails): Execution parameters of tools must be regulated beyond simple binary access to restrict specific parameters and operations.
- [12:20](https://www.youtube.com/watch?v=VJN_6sKVf34&t=740s) Control Point 4 (Output Guardrails): Final AI responses require real-time inspection to mask or redact sensitive information like PII before output delivery.
- [18:14](https://www.youtube.com/watch?v=VJN_6sKVf34&t=1094s) Managing agentic AI security at enterprise scale requires centralized, policy-driven authorization across all stages of the AI pipeline.
## Detailed walkthrough
Here is a detailed, faithful walkthrough based on the transcript from the session *Setting Boundaries for Agentic AI: Preventing Data Exposure at Enterprise Scale With PlainID*.
---
[00:04](https://www.youtube.com/watch?v=VJN_6sKVf34&t=4s) A New Era of Non-Human Identities: Agents as Active Employees
Gal Helemski, Co-Founder and Chief Product Officer (CPO) of PlainID, opens the presentation by framing identity security as the single hottest topic within agentic AI. While organizations have spent decades securing human access and predictable application or service connections, AI agents introduce a fundamentally new security threat. Rather than merely supplying knowledge or retrieving information, agents actually take direct action on behalf of human users.
Helemski encourages the audience to think of an AI agent as a "new type of employee" operating inside the enterprise. Uniquely, agents are explicitly engineered to please whoever is operating them, meaning they will proactively push boundaries and do whatever it takes to complete a task. This shift requires establishing proper security boundaries from day one rather than retroactively patching controls.
- Agents act dynamically rather than just surfacing knowledge, functioning like autonomous employees.
- Security and AI leaders have a brief, critical window to implement correct controls at launch rather than fixing vulnerabilities later.
---
[02:30](https://www.youtube.com/watch?v=VJN_6sKVf34&t=150s) Understanding Intent: The Airport Analogy
To illustrate why identity alone is insufficient for AI, Helemski uses the analogy of an airport security check. When a traveler arrives at an airport, they present a government-issued passport verifying their identity and a ticket showing their destination. Even though identity and destination are fully proven, security officers still ask probing questions: *"Did you park by yourself? Where are you going? Who are you traveling with?"* The purpose of these questions is to determine the traveler's *intent*.
Traditional identity systems verify *who* an actor is and *what* they are allowed to reach, but they completely miss the *why*. For AI agents acting on behalf of human users, organizations must evaluate why an operation is happening at a specific moment in time before permitting it.
- Identity verification (e.g., holding a signed credential) only answers *who*; it does not reveal *intent*.
- Access decisions for agents must evaluate the real-time context: why a specific action is being triggered now and under what exact process flow.
---
[04:15](https://www.youtube.com/watch?v=VJN_6sKVf34&t=255s) The Spectrum of Identities: Humans, Systems, and AI Agents
Helemski breaks down the structural differences between three distinct identity types:
1. **Human Identities:** Highly predictable. Humans generally know why they are accessing a system, and their operations follow auditable, established pathways.
2. **Traditional Non-Human Identities (System/Service Accounts):** Extremely deterministic. A standard service account follows a fixed execution path from Point A to Point B and cannot change its behavior on the fly.
3. **AI Agent Identities:** Highly unpredictable. Agents possess a reasoning engine ("a brain") that allows them to make real-time decisions, pivot mid-task, choose new tools, or request unexpected datasets to fulfill a prompt.
Because an agent's path is entirely dynamic and nondeterministic, relying on static, predefined permission sets fails to prevent abuse.
- Standard service accounts follow linear paths; AI agents continuously decide whether to turn left or right during task execution.
- Static, permission-based access models cannot scale or capture dynamic intent.
---
[06:18](https://www.youtube.com/watch?v=VJN_6sKVf34&t=378s) Unpacking "Intent-Based Access Control" and Its Components
Static permissions define what is *possible*, but they fail to determine whether an action is *appropriate* at a given moment. For instance, an agent may legitimately possess the capability to send emails. However, if an agent uses that tool to blast thousands of emails externally or exfiltrate sensitive data, it is abusing its execution rights.
```
+-------------------------------------------------------------+
| INTENT EVALUATION ENGINE |
+-------------------------------+-----------------------------+
|
+-----------------------------+-----------------------------+
| | |
v v v
+-------+ +-----------+ +-----------+
| ACTOR | | TARGET | | CONTEXT |
| Human | | Records | | Process |
| Agent | | Data / HR | | Time/Flow |
+-------+ +-----------+ +-----------+
```
To evaluate "intent," an access control system must analyze several key context signals simultaneously:
- **Identities Involved:** Both the underlying human user and the intermediate AI agent acting on their behalf.
- **Target Resources:** The specific data or assets being requested (e.g., HR data, financial records, customer support logs).
- **Process Context & Flow:** The preceding steps, the time of the request, and the specific operation being executed (e.g., sending an email vs. querying a database).
---
[09:32](https://www.youtube.com/watch?v=VJN_6sKVf34&t=572s) Enforcing Intent Through Runtime Authorization
Controlling intent requires a system that ingests real-time contextual signals and evaluates them against centralized security policies. This framework is **Runtime Authorization**. Policies serve as the formal definition of *approved intent*, governing access dynamically as the agent acts.
Key attributes of true runtime authorization include:
- **Continuous Evaluation:** Decisions are evaluated *during* execution at every step of the agentic workflow—never statically defined ahead of time or audited only after the fact.
- **Policy-Driven Governance:** Fine-grained policies dictate whether the detected combination of user, agent, task, and target data meets enterprise security boundaries.
---
[12:20](https://www.youtube.com/watch?v=VJN_6sKVf34&t=740s) The Four Critical Control Points in an Agentic AI Flow
Helemski walks through a typical high-level agentic architecture—starting at the user prompt, proceeding through data retrieval and Model Context Protocol (MCP) tool execution, and concluding with the generated response. To secure this architecture, enterprises must enforce security policies across four distinct control points.
```
[ Prompt / Input ] ---> Control Point 1: Input Guardrails
|
v
[ Data Retrieval ] ---> Control Point 2: Pre-Retrieval Data Filtering
|
v
[ MCP Tool Usage ] ---> Control Point 3: Fine-Grained Tool Execution
|
v
[ Output / Resp ] ---> Control Point 4: Output Masking / Redaction
```
1. **Control Point 1: Input Guardrails (Prompt Control)**
- Blocks unauthorized queries at the front door before the flow ever touches backend data or tools.
- *Example:* A support agent should be blocked immediately if a user prompts it with human resources or financial queries. Traditional operational guardrails must be augmented with real-time authorization checks.
2. **Control Point 2: Pre-Retrieval Data Guardrails**
- Applies strict filtering *before* data is fetched from structured databases or unstructured document stores (e.g., Google Drive, enterprise repositories).
- Enforces context-based boundaries so agents only retrieve what is strictly necessary (e.g., restricting queries to US-only non-sensitive records).
3. **Control Point 3: MCP Tool Guardrails**
- Regulates tool utilization via standards like the Model Context Protocol (MCP).
- Moves beyond binary tool access to inspect execution parameters (e.g., allowing an agent to draft an email, but blocking it from sending mass emails to external domains).
4. **Control Point 4: Output Guardrails**
- Inspects the final generated response before it reaches the end user to mask or redact sensitive information, such as Personally Identifiable Information (PII).
---
[18:14](https://www.youtube.com/watch?v=VJN_6sKVf34&t=1094s) Key Takeaways and Conclusion
Helemski concludes by emphasizing that managing autonomous AI access through individual static assignments is unworkable at scale. Centralized, policy-driven runtime authorization is the only viable method to govern agentic workflows effectively.
- **Intent Over Action:** Agentic AI authorization fails if actions are approved without evaluating intent.
- **Permissions Are Insufficient:** Entitlements state what is technically possible, not what is appropriate at runtime.
- **Constrain Purpose:** Secure how tools and data are used rather than simply toggling tool access on or off.
- **Continuous Evaluation:** Enforce authorization continuously across all four control points throughout the agentic pipeline.
*Gal Helemski closes the session by inviting attendees to visit PlainID at Booth 1045.*
## Notable quotes
> [02:30](https://www.youtube.com/watch?v=VJN_6sKVf34&t=150s) Did you park by yourself? Where are you going? Who are you traveling with? — Gal Helemski
## Mentioned
Gal Helemski, PlainID, Ai4, Model Context Protocol
## Video description
Gal Helemski - Cofounder & Chief Product (CPO), PlainID
Agentic AI systems retrieve data directly or via MCP tools, yet most lack built-in controls. Without clear security boundaries, they can expose sensitive data and disrupt operations within seconds. As a result, enforcing guardrails across the entire AI flow and centrally managing access for all identities, human and machine, has become critical. This session explores how runtime controls are applied and enforced across distributed environments to enable secure, scalable agentic AI.
PlainID推出面向代理式AI数据保护的运行时控制机制
Gal Helemski指出静态权限无法保护企业系统免受自主代理的风险，需要在四个不同的流水线控制点实施基于意图的实时授权。
Gal Helemski将AI代理定义为一类新型的自主非人类员工，它们进行动态推理决策，而非遵循静态、确定性的代码。由于代理会主动执行任务且可能越过标准权限边界，传统的身份检查无法判断某项操作是否合规。为了降低风险，Helemski提出了通过运行时授权实现的“基于意图的访问控制”，该机制能够持续评估上下文、涉及的身份、目标资产和流程走向。演讲详细阐述了如何在四个关键控制点落实这些由策略驱动的防护护栏：输入提示词、数据预检索、MCP工具执行以及输出脱敏。
身份安全已成为代理式AI的核心挑战，因为代理是直接采取行动的自主实体，而不仅是检索信息。 (0:04)
与传统的非人类身份不同，AI代理的设计初衷是取悦用户，并且会为了完成任务而主动突破边界。 (0:04)
仅凭身份验证和目标地址证明不足以确保AI安全；系统必须评估执行者的实时“意图”。 (2:30)
与人类用户或标准的线性服务账户相比，AI代理具有非确定性和高度不可预测性，这使得静态权限模型彻底过时。 (4:15)
基于意图的访问控制会同时评估多种信号的组合：人类用户、正在运行的代理、目标资源以及流程上下文。 (6:18)
Reading summary
Gal Helemski, Co-Founder and Chief Product Officer of PlainID, argues that autonomous AI agents cannot be secured through traditional static permissions and require continuous, intent-based runtime authorization. Because agents act dynamically on behalf of human users, access control systems must evaluate real-time operational context to determine whether an action is appropriate before permitting execution.
Agent Nondeterminism and Limits of Static Access (4:15)
Helemski categorizes AI agents as a distinct class of non-human identity that operates like autonomous employees within the enterprise. Unlike traditional service accounts that follow deterministic, linear pathways between predefined endpoints, AI agents possess reasoning engines that allow them to make real-time decisions, select tools dynamically, and alter execution paths to satisfy user requests. Because agents are engineered to complete objectives proactively, Helemski asserts that relying on static, pre-assigned entitlements only specifies what an agent is technically capable of executing. Static permissions fail to prevent abuse, such as an agent legitimately permitted to send emails suddenly executing mass external data exfiltration.
Evaluating Intent Through Multi-Factor Context (2:30)
To explain the gap in traditional security, Helemski compares identity checks to airport security: holding a passport and boarding pass confirms identity and destination, but probing questions are necessary to uncover a traveler's intent. Traditional access models identify who an actor is and what resource they can reach, but they lack visibility into why an operation is occurring. Intent-based access control requires evaluating several contextual factors simultaneously, including the human operator, the intermediate agent identity, the target data assets, and the specific process flow and timing. Helemski maintains that runtime authorization must continuously evaluate these signals against centralized security policies during task execution rather than relying on static definitions or post-action audits.
Four Pipeline Control Points for Agent Governance (12:20)
Helemski details a framework to enforce intent-based security across four control points in the agentic workflow. First, input guardrails enforce authorization at the prompt level to block unauthorized tasks before they reach backend tools, such as barring a support agent from handling financial queries. Second, pre-retrieval data guardrails apply contextual filtering to structured and unstructured repositories before records are fetched, limiting access to necessary parameters like non-sensitive regional data. Third, tool execution guardrails regulate protocols such as the Model Context Protocol (MCP) by inspecting runtime parameters rather than binary permissions, permitting actions like drafting an email while preventing unauthorized external distribution. Fourth, output guardrails inspect and redact sensitive elements, including personally identifiable information, before final delivery.
Helemski concludes that static, individual permission management cannot scale to meet the unpredictability of autonomous agents, making centralized runtime authorization the only viable model for enterprise governance. She cautions that security leaders face a brief, critical window to implement these boundaries at launch rather than attempting to remediate agent vulnerabilities after deployment.
## Background
本内容由 Ai4 频道于 2026 年 8 月 14 日发布在 YouTube 平台。视频记录了 PlainID 联合创始人兼首席产品官 Gal Helemski 的主题演讲，主要探讨在智能体 AI（Agentic AI）广泛通过 MCP 工具检索数据的背景下，企业如何通过运行时控制在全流程建立安全边界以防止数据泄露。
## TL;DR
Gal Helemski 指出，AI 智能体具有高度自主决策能力，传统针对人类和服务账户的静态权限机制已全面失效。通过类比机场安检，她强调访问控制必须从验证“身份与权限”升级为洞察行为背后的“意图”。为此，企业必须引入毫秒级策略驱动的“运行时授权”，并在输入 Prompt、数据检索、MCP 工具调用和输出 Response 四个关键卡点全面部署意图护栏，实现端到端的安全治理。
## Atmosphere & style
整个演讲专业干练且极具说服力，讲者以清晰透彻的企业安全视角直击技术痛点。通过将智能体比作“竭力取悦用户的新员工”以及引用“机场安检盘问”等生动比喻，将晦涩的授权架构化繁为简。现场节奏紧凑、逻辑层层推进，在向行业敲响安全警钟的同时，也展现出对建立前瞻性 AI 治理体系的坚定信心。
## Key takeaways
- [00:04](https://www.youtube.com/watch?v=VJN_6sKVf34&t=4s) 智能体 AI 正在演进为组织内部的“新型员工”，它们具备自主推理与寻路能力，其核心驱动力是竭尽全力满足使用者，打破了传统软件确定性的安全范式。
- [02:30](https://www.youtube.com/watch?v=VJN_6sKVf34&t=150s) 如同机场安检不仅核验护照与机票更会盘问出行目的，智能体访问控制不能仅停留在验证身份，必须深入洞察行为背后的“意图”（Intent）。
- [04:09](https://www.youtube.com/watch?v=VJN_6sKVf34&t=249s) 与人类和遵循固定脚本的服务账户相比，AI 智能体的行为路径具有高度动态性和不可预测性，传统静态控制机制已无法有效治理。
- [06:06](https://www.youtube.com/watch?v=VJN_6sKVf34&t=366s) 静态权限仅界定了“什么是可能的”，但无法判定在当前具体业务上下文中该行为是否“得体且被认可”，必须引入意图访问控制。
- [06:06](https://www.youtube.com/watch?v=VJN_6sKVf34&t=366s) 意图的判定依赖于完整的上下文拼图，包括背后的人类身份、智能体身份、操作标的数据以及触发该动作的因果业务流程节点。
- [09:26](https://www.youtube.com/watch?v=VJN_6sKVf34&t=566s) 运行时授权（Runtime Authorization）必须在智能体执行操作的毫秒级当下动态评估策略，取代事前的静态配置或事后的审计追责。
- [12:20](https://www.youtube.com/watch?v=VJN_6sKVf34&t=740s) 在输入护栏（Input Guardrails）阶段前置进行鉴权与跨域意图拦截，防止不合规的 Prompt 穿透触发后续数据检索与工具调用。
- [12:20](https://www.youtube.com/watch?v=VJN_6sKVf34&t=740s) 在数据护栏（Data Guardrails）阶段实行“检索前过滤”，基于上下文与意图限定智能体接触的数据范围，避免暴露泛化机密数据。
- [12:20](https://www.youtube.com/watch?v=VJN_6sKVf34&t=740s) 在工具与 MCP 护栏阶段，管控重点应从“能否调用工具”深入到“如何使用工具”，细化限制调用参数、外发目标与执行频次。
- [12:20](https://www.youtube.com/watch?v=VJN_6sKVf34&t=740s) 在输出护栏（Output Guardrails）阶段对生成的 Response 实施实时 PII 与敏感数据脱敏掩码，守住最后一道防线。
- [18:14](https://www.youtube.com/watch?v=VJN_6sKVf34&t=1094s) 企业必须构建贯穿 Prompt、检索、MCP 工具与 Response 全流程的意图驱动安全策略网络，从部署第一天起确立运行时控制体系。
## Detailed walkthrough
### [00:04](https://www.youtube.com/watch?v=VJN_6sKVf34&t=4s) 身份安全的新范式：当智能体成为组织中的“新员工”
在大会现场，PlainID 联合创始人兼首席技术官 Gal Helemski 登台指出，身份安全已经成为智能体 AI（Agentic AI）领域最炙手可热的话题。过去的系统安全主要围绕人类用户和传统的应用程序、后台服务展开，但随着自主智能体的入场，全新的行为模式与安全威胁悄然形成。企业不能再将智能体视作单纯的信息提取工具，因为它们不再只是为人类提供知识与数据，而是在真实世界中替人类采取行动。
Gal Helemski 提出了一个形象的视角：应该将 AI 智能体视为组织内部的“新型员工”。传统软件系统只会刻板地执行既定指令，但智能体截然不同——它们在底层设计上就倾向于竭尽全力去“取悦”（please）操作它的使用者。为了达成目标，智能体会在其边界内想尽一切办法寻找路径。这种自主性不仅打破了以往系统运行的范式，更对安全防线提出了极为严峻的考验。不过，她也向在场的 AI 与安全领袖强调，这也是一个从第一天起就“把事情做对”的历史机遇，行业不必重蹈覆辙走“先上线后打补丁”的老路，而应在当下就为所有智能体建立健全的控制体系。
- **核心转变**：从被动的“信息检索与呈现”演进为具备行动力的“自主执行”。
- **行为驱动力**：智能体被设计为不惜代价去满足操作者的需求，在边界内自主摸索实现路径。
- **治理时机**：在智能体规模化部署的第一天确立控制机制，避免传统 IT“亡羊补牢”式的安全困局。
---
### [02:30](https://www.youtube.com/watch?v=VJN_6sKVf34&t=150s) 机场安检的启示：验证身份之后，更要洞察“意图”
为了厘清什么是真正的智能体治理，Gal Helemski 抛出了一个每个人都亲身经历过的场景——机场安检。当你抵达机场时，手中持有由政府颁发并核验的护照，以及注明航班信息的机票。此时，机场系统非常确切地知道“你是谁”（身份已验证），也清楚“你将要去哪里”（目的地已确定）。然而，安检人员依然会连珠炮似地询问一系列看似多余的问题：“行李是你自己打包的吗？”“你去那里做什么？”“你和谁一起旅行？”
这一系列询问的核心目的，不是为了二次验证身份，而是在刺探“意图”（Intent）。护照和机票无法证明旅客真正的动机，而行为动机恰恰是潜在安全威胁的关键所在。智能体访问控制同理：仅仅确认“它是一个获得了某种审批的合法智能体”是远远不够的。企业必须追问深层次的意图：它代表哪位人类用户操作？为什么要在此刻执行这一特定操作？为什么选择访问这一批敏感数据？
```mermaid
flowchart LR
accTitle: 机场安检与智能体安全对比
subgraph 传统身份验证
A["护照 / API Token"] --> C["确认身份：你是谁？"]
B["机票 / 授权范围"] --> D["确认目标：你去哪 / 访问什么？"]
end
subgraph 意图访问控制
E["安检盘问 / 运行时策略"] --> F["洞察意图：为什么现在做？行为是否合理？"]
end
```
---
### [04:09](https://www.youtube.com/watch?v=VJN_6sKVf34&t=249s) 身份演进与不可预测性：人类、服务账户与 AI 智能体
为了深入剖析为何现有的访问控制系统必须全面升级，Gal Helemski 将组织中并存的三种身份形态进行了纵向对比。第一类是人类身份（Human Identity）。人类行为在整体上是可预测、可审计且可治理的；用户登录系统前通常明确知道自己要做什么、为何要访问，其访问路径长期以来已被成熟的权限体系较好地覆盖。第二类是传统的非人类身份（Non-Human Identity），如后台应用和服务账户（Service Accounts）。这类系统遵循从 A 点直达 B 点的预设脚本，无法突发奇想中途转向，其行为路径高度可预测，企业早已掌握其治理模式。
然而，AI 智能体的降临彻底打破了这一确定性世界。智能体不可预测的核心原因在于“它们拥有大脑”。在执行任务的过程中，智能体可以实时决定向左拐还是向右拐，可以在推进过程中自行判断是否需要引入外部工具或检索特定数据。因为其路径是高度动态的，如果企业继续沿用过去服务于人类或静态服务账户的机械控制机制，安全防护体系必然在智能体时代全面失效。
| 身份类型 | 行为路径特征 | 决策机制 | 治理与控制难度 |
|:--- |:--- |:--- |:--- |
| **人类身份 (Human)** | 具备自知性，意图明确且可审计 | 主观动机清晰，遵循组织流程 | 已有成熟工具，整体路径相对可控 |
| **服务账户 (Service Account)** | 严格按照代码从 A 到 B 预设执行 | 无自主决策权，完全不可擅自变更路径 | 高度静态，可通过固定策略有效治理 |
| **AI 智能体 (Agent)** | 动态调整、实时变轨，高度不可预测 | 具备自主推理能力，为达成目标动态决策 | 传统静态控制失效，必须依赖动态控制系统 |
---
### [06:06](https://www.youtube.com/watch?v=VJN_6sKVf34&t=366s) 静态权限之困：权限决定“能做什么”，意图决定“应不应该做”
Gal Helemski 明确指出，如果企业依然依靠预先定义的静态权限去限制智能体，不仅无法适应业务的规模化扩展，更无法识别并拦截恶意的或失控的意图。她以一个非常普遍的智能体能力为例：许多智能体都被赋予了“发送电子邮件”的权限，在日常自动化中这无可厚非。但如果智能体滥用这一权限，在瞬间发出海量邮件，甚至将未经脱敏的核心机密数据直接附在邮件中发送出去，整个系统就会面临严重的数据泄漏与服务滥用风险。
正因如此，“权限只说明了什么是可能的，但无法说明在此时此刻这么做是否恰当”（"Permissions only tell what's possible, not if it is appropriate to use right now"）。这正是引入“意图访问控制”（Intent Access Control）的分水岭。所谓意图，本质上是行为背后的根本目的（the purpose behind the action）。在做出任何访问裁决之前，控制系统必须实时捕捉并分析全方位的上下文信号：背后的人类操作者是谁、调用的是哪个智能体、正在尝试调取支持记录、财务数据还是人力资源档案、是怎样的业务处理流程逐步将它们导向了当前这一步动作。只有拼凑出这幅完整的上下文图景，系统才能精准判定行为的合理性。
- **意图的构成要素**：
- **参与主体**：关联的人类身份与执行任务的非人类/智能体身份。
- **操作标的**：试图读取、修改的具体业务数据（如财务、人事或支持工单）。
- **因果链路**：导致触发该操作的上下文事件序列与业务流程节点。
- **时空环境**：为何偏偏在此刻、以此种频次与方式调用资源。
---
### [09:26](https://www.youtube.com/watch?v=VJN_6sKVf34&t=566s) 运行时授权机制：让安全策略动态捕捉并裁决意图
理解了意图的内涵后，核心工程问题随之而来：如何落地并控制意图？Gal Helemski 解释道，企业需要一套能够实时采集所有上下文信号并与安全策略进行即时校验的系统。策略（Policy）是定义“何为合规意图”的唯一手段，而真正将这些策略转化为实战防线的正是“运行时授权”（Runtime Authorization）。
真正的运行时授权绝非事前的静态配置，也绝非事后的审计追责，而是在智能体采取行动的“当下毫秒级时间内”进行实时判定。由于智能体行进路线的每一步都充满动态变数，运行时授权引擎必须随着智能体执行流的推移进行持续评估，在每一个节点反复核实当前意图是否完全契合安全策略规范。只有这样，才能在保障智能体灵活推理的同时，确保数据不越雷池一步。
```mermaid
flowchart TD
accTitle: 运行时意图访问控制决策机制
A["智能体行为发起 (操作/调用/检索)"] --> B["实时捕获上下文信号\n(人类身份, 智能体身份, 流程节点, 目标数据)"]
B --> C{"运行时授权引擎\n(Runtime Authorization)"}
D["集中式安全策略库\n(已核准的意图规则)"] --> C
C -- "意图合规" --> E["放行并执行操作"]
C -- "偏离/违规意图" --> F["即时阻断 / 降级拦截"]
```
---
### [12:20](https://www.youtube.com/watch?v=VJN_6sKVf34&t=740s) 智能体全流程四大控制点：提示词、数据检索、MCP 工具与响应过滤
针对企业实际落地，Gal Helemski 梳理了一个典型的智能体端到端工作流：用户输入 Prompt，智能体启动数据检索，可能借助 MCP（Model Context Protocol）调用外部工具，最终组装并输出 Response。在这个生命周期中，企业必须在四大关键卡点部署意图级防护：
```mermaid
flowchart LR
accTitle: 智能体全流程四大控制点架构图
P["输入 Prompt"] -->|控制点 1: 输入护栏| R["数据检索 Data Retrieval"]
R -->|控制点 2: 数据护栏| T["工具调用 MCP Tools"]
T -->|控制点 3: 工具护栏| O["输出 Response"]
O -->|控制点 4: 输出护栏| U["最终呈现用户"]
subgraph "四道运行时安全卡点"
direction TB
C1["1. 输入护栏: 身份鉴权与跨域阻断"]
C2["2. 数据护栏: 检索前按上下文过滤"]
C3["3. 工具护栏: 细粒度管控调用方式与暴露面"]
C4["4. 输出护栏: PII 敏感信息掩码脱敏"]
end
C1 -.-> P
C2 -.-> R
C3 -.-> T
C4 -.-> O
```
1. **第一控制点：输入护栏（Input Guardrails）**
绝不能允许用户或上游智能体随心所欲提出任何问题。安全控制必须前置在 Prompt 阶段，在数据被调取、工具被唤醒之前就掐断潜在风险。以往业界谈及护栏多指“操作性合规护栏”，但真正缺失的是“鉴权与意图护栏”。例如，当一个客服售后智能体被提问财务账目或 HR 敏感薪酬时，系统必须在提示词阶段予以判定并直接拦截，避免流程继续向下穿透。
2. **第二控制点：数据护栏（Data Guardrails）**
随着智能体被广泛接入 Google Drive、内部知识库与结构化数据库，组织面临着空前的数据暴露面。智能体不需要、也不应该接触流程无关的泛化数据。企业必须基于当前人类上下文与任务意图，实施“检索前过滤”（Filtering before retrieval），而非提取出全部数据后再做筛选。例如：限定智能体仅能检索美国本土记录而不能碰触欧洲数据，或者仅允许读取非机密分级文档。
3. **第三控制点：工具调用与 MCP 护栏（Tool & MCP Guardrails）**
模型上下文协议（MCP）等标准使得智能体能自如调取外部系统。传统的安全仅关注“该智能体是否有权调用此工具”，但这过于初级。真正的控制在于“工具是如何被使用的”：智能体是否将邮件发往了组织外部域名？是否在一秒钟内触发了上百封邮件？该工具调用带出了哪些深层数据？必须细化到具体的参数、行为频次与外发目标。
4. **第四控制点：输出护栏（Output Guardrails）**
哪怕在检索和工具层面设置了多重关卡，模型在整合生成最终响应（Response）时，仍有可能夹带敏感的个人身份信息（PII）或敏感商业数据。输出护栏作为最后一道防线，负责对这些生成内容进行实时的脱敏掩码处理，确保终端展示内容绝对合规。
---
### [18:14](https://www.youtube.com/watch?v=VJN_6sKVf34&t=1094s) 核心总结与行动建议：构建面向自主智能体的策略驱动治理
在演讲尾声，Gal Helemski 总结道，在高度自主的智能体时代，仅靠个别分配或静态定义的权限早已无法维系系统的安全性，唯一可行的治理路径是建立全面捕捉并约束意图的策略网络。她为在场的架构师与安全团队提炼了五条核心结论：
- **无意图即失败**：脱离意图而直接授权动作的智能体架构注定会暴露出致命安全漏洞。静态准入机制无法真正实现安全管控。
- **重新审视权限定义**：权限只界定了理论上的“可能性”，绝不代表该行为在特定业务场景下是“得体且被认可的”。
- **约束业务目的，而非仅限制工具**：安全治理的重点不在于“智能体能否调用这个 MCP 工具”，而在于“智能体为什么在此时以此种方式调用该工具”。
- **全面践行运行时评估**：在执行链路的每一个瞬时节点动态判定访问请求，取代传统的离线预授权。
- **全流程贯穿意图感知**：从输入的 Prompt、检索的数据、调用的 MCP 工具到最终返回的 Response，四大控制点必须全部依托意图驱动的策略进行协同防御。
## Notable quotes
> [00:04](https://www.youtube.com/watch?v=VJN_6sKVf34&t=4s) 身份安全已经成为智能体 AI（Agentic AI）领域最炙手可热的话题。 — Gal Helemski
> [00:04](https://www.youtube.com/watch?v=VJN_6sKVf34&t=4s) 它们在底层设计上就倾向于竭尽全力去“取悦”（please）操作它的使用者。为了达成目标，智能体会在其边界内想尽一切办法寻找路径。 — Gal Helemski
> [00:04](https://www.youtube.com/watch?v=VJN_6sKVf34&t=4s) 这也是一个从第一天起就“把事情做对”的历史机遇，行业不必重蹈覆辙走“先上线后打补丁”的老路。 — Gal Helemski
> [02:30](https://www.youtube.com/watch?v=VJN_6sKVf34&t=150s) 这一系列询问的核心目的，不是为了二次验证身份，而是在刺探“意图”（Intent）。 — Gal Helemski
> [04:09](https://www.youtube.com/watch?v=VJN_6sKVf34&t=249s) 智能体不可预测的核心原因在于“它们拥有大脑”。 — Gal Helemski
> [06:06](https://www.youtube.com/watch?v=VJN_6sKVf34&t=366s) Permissions only tell what's possible, not if it is appropriate to use right now — Gal Helemski
> [06:06](https://www.youtube.com/watch?v=VJN_6sKVf34&t=366s) 所谓意图，本质上是行为背后的根本目的（the purpose behind the action）。 — Gal Helemski
> [09:26](https://www.youtube.com/watch?v=VJN_6sKVf34&t=566s) 真正的运行时授权绝非事前的静态配置，也绝非事后的审计追责，而是在智能体采取行动的“当下毫秒级时间内”进行实时判定。 — Gal Helemski
> [12:20](https://www.youtube.com/watch?v=VJN_6sKVf34&t=740s) 绝不能允许用户或上游智能体随心所欲提出任何问题。安全控制必须前置在 Prompt 阶段，在数据被调取、工具被唤醒之前就掐断潜在风险。 — Gal Helemski
> [18:14](https://www.youtube.com/watch?v=VJN_6sKVf34&t=1094s) 脱离意图而直接授权动作的智能体架构注定会暴露出致命安全漏洞。静态准入机制无法真正实现安全管控。 — Gal Helemski
## Mentioned
Gal Helemski, PlainID, Ai4, Agentic AI, MCP (Model Context Protocol), Runtime Authorization, Google Drive
## Video description
Gal Helemski - Cofounder & Chief Product (CPO), PlainID
Agentic AI systems retrieve data directly or via MCP tools, yet most lack built-in controls. Without clear security boundaries, they can expose sensitive data and disrupt operations within seconds. As a result, enforcing guardrails across the entire AI flow and centrally managing access for all identities, human and machine, has become critical. This session explores how runtime controls are applied and enforced across distributed environments to enable secure, scalable agentic AI.
[Source](https://www.youtube.com/watch?v=VJN_6sKVf34)
Source quotes
[0:04] Gal Helemski: 身份安全已经成为智能体 AI（Agentic AI）领域最炙手可热的话题。
[0:04] Gal Helemski: 它们在底层设计上就倾向于竭尽全力去“取悦”（please）操作它的使用者。为了达成目标，智能体会在其边界内想尽一切办法寻找路径。
[0:04] Gal Helemski: 这也是一个从第一天起就“把事情做对”的历史机遇，行业不必重蹈覆辙走“先上线后打补丁”的老路。
[2:30] Gal Helemski: 这一系列询问的核心目的，不是为了二次验证身份，而是在刺探“意图”（Intent）。
[4:09] Gal Helemski: 智能体不可预测的核心原因在于“它们拥有大脑”。
[6:06] Gal Helemski: Permissions only tell what's possible, not if it is appropriate to use right now
[6:06] Gal Helemski: 所谓意图，本质上是行为背后的根本目的（the purpose behind the action）。
[9:26] Gal Helemski: 真正的运行时授权绝非事前的静态配置，也绝非事后的审计追责，而是在智能体采取行动的“当下毫秒级时间内”进行实时判定。
[12:20] Gal Helemski: 绝不能允许用户或上游智能体随心所欲提出任何问题。安全控制必须前置在 Prompt 阶段，在数据被调取、工具被唤醒之前就掐断潜在风险。
[18:14] Gal Helemski: 脱离意图而直接授权动作的智能体架构注定会暴露出致命安全漏洞。静态准入机制无法真正实现安全管控。
Source quotes
[2:30] Gal Helemski: Did you park by yourself? Where are you going? Who are you traveling with?
Original transcript
[0:04] I'm Gal. I'm the CTO of Plane ID. We are an
identity security company. That's our focus.
[0:10] And it seems like identity security is the hottest
topic in identic AI. I don't know if you saw that,
[0:17] but at least that's how I'm experiencing. And I'm
going to talk about how to control how to govern
[0:25] the agentic access uh throughout the agentic flow
especially when it comes to controlling access to
[0:32] data. So so that's the topic. Um and first of all
I'm going to start by erh uh explaining what has
[0:41] changed what has really changed because uh we had
humans accessing you know data and all kinds of
[0:49] other services we had applications we had um uh
services doing the same. Then the identity kind
[0:58] of introduced a new pattern and obviously new
threat to that uh to to that area. So what has
[1:06] changed? What has changed is that h they have
started the agents right they have started not
[1:13] only to provide us with knowledge and information
they are also acting. I like to look at agent as
[1:21] a new type of employee that operates within our
organization and we really need to acknowledge
[1:27] that they're not just doing what we ask them
to do. They're trying really really trying to
[1:33] do much more than that. agents are designed to
please whoever is operating them and they would
[1:40] do whatever is within their boundaries to achieve
that task and that's really a a significant shift
[1:48] in how systems operated before. Additionally,
another thing I want to say that has changed
[1:55] is the opportunity here. So you are some of you
are identic leaders, AI leaders, security leaders
[2:03] maybe even if you didn't go to the blackhead you
maybe came here anyway. Uh this is the opportunity
[2:10] to really make it right day one and not try to fix
things later because traditionally that's how you
[2:17] know we were operating. There is an opportunity to
set the right controls today to all those agents.
[2:25] Now understanding what the right controls are
that's what I'm going to talk about. Let's
[2:30] start with understanding intent and I want
to give you an example. Whenever you go to
[2:36] an airport and everyone is familiar with this type
of scenario, right? Whenever you go to an airport,
[2:42] yes, you have your passport and yes, you have
your ticket. So the everyone knows who you are
[2:49] because you have a you have your passport and it's
signed by the government and you have your ticket.
[2:55] So destination is known but intent is unknown
and you still get asked all those questions.
[3:04] Did you park by yourself? Where are you going?
Who are you traveling with? The intention of all
[3:09] those questions is to understand your intent. Even
though your identity is verified and where you're
[3:19] going is proved by the ticket that you hold, still
you get asked all those questions. Maybe some
[3:25] airlines are asking more than others, but still
the the intention is to understand your intent
[3:32] in traveling and that's what we need to do also
with agents. It's not enough just to have their
[3:40] identity in place. It's not enough just to
understand. Yes, I'm an agent and someone gave
[3:46] me this approval. No, it's not enough. We need to
understand why they're trying to do what they're
[3:54] doing. They are acting on behalf of a human
identity and they're trying to do an operation.
[4:01] Why now? Why this type of operation? And in order
to truly understand why controls need to change,
[4:09] they need to advance. Let's talk about
the difference between our three types of
[4:15] identities. Starting with the human identity. We
have human identity. That's how we operated up
[4:22] until now. This human identity was pretty
much predictable. Think about yourself,
[4:29] right? Whenever you're going to access any system,
you know what you want to do. You know why you're
[4:36] accessing that system. your operations are
whatever you're doing right it's fully auditable
[4:42] it's governed so pretty much things are known and
understood and I must say maybe we were able to
[4:50] kind of control that access path and then came the
nonhuman identity the systems or the systems even
[5:00] systems they have a very predictable path starting
from A going all the way to B that's predetermined
[5:08] they can't h instantly change their their mind
to go in a different direction. That's not how
[5:14] system traditionally operate. So even the service
accounts are predictable. We knew how to govern
[5:21] them. Well, that all changed with AI agents.
AI agents are unpredictable. Why? Because they
[5:29] have a brain. They can decide on the go where
if to turn left or right. They can decide they
[5:37] need this data now. They need this tool now. They
can make decisions and they are designed to make
[5:44] those type of decisions in order to to please
to please whoever is operating them. That's how
[5:51] they are designed. So just because of that that
just because they can make their own decisions,
[5:57] their path is not predetermined. Everything is
dynamic and that calls for this type of control
[6:06] system, a dynamic control system rather than the
static ones we used to use up until now. So we
[6:18] are h we are using the wrong control systems. If
we are still controlling our agents using static
[6:25] predefined controls, well that cannot scale and
obviously it cannot capture the intent of our
[6:33] agents. Just look at those couple of examples I um
I'm presenting, right? So let's say an agent has
[6:42] the ability to send emails. That's a very common
task. Why not send emails? But if they're abusing
[6:49] that capability, if they're abusing that in order
to send huge amounts of emails, they shouldn't be
[6:56] uh sending maybe even to expose sensitive data,
right? If they can send emails, they can put
[7:02] any data in that emails in in those emails, then
that's abusing their ability to operate in that
[7:11] capacity. And that that and and there's also
that other example here. So permissions only
[7:18] tell what's possible not if it is appropriate
to use right now. That's where intent access
[7:27] control comes in. Now let's look at what do I mean
when I say intent? I I I mentioned intent several
[7:35] times already. What do I mean when I mention
intent? Intent is basically the purpose behind
[7:43] the action is our it's our ability to capture the
why the why this is happening why it's happening
[7:50] now why this agent for this human user is hap
is acting um on on this type of action trying
[7:58] to access this data when we try to capture intent
we need to understand several things first of all
[8:06] identities involved human non-human, right? We
need to understand who are our actors. That's
[8:13] one. What are they trying to do? They're trying
to access uh support records, financial data,
[8:21] HR data. What are they trying to do? Why are
they trying to do that now? What is the flow
[8:28] of a process they were following that led them
into this specific action? sending emails,
[8:35] exposing data, um I don't know, putting more
fun fans in in whatever. So all of that is being
[8:45] captured under intent. Understanding all those
elements is eventually what leads to intent.
[8:58] Um okay, I apologize for that. I just realized
I was speaking on the wrong slide. Anyway,
[9:04] everything I just said belongs to this
slide. So, kind of rerun it. Okay. Uh,
[9:10] this is intent. Okay. All the things that we
want to uh all the things that we want to capture
[9:17] uh as part of the access decision is what is def
is this is what intent is actually capturing. Now,
[9:26] understanding what intent is. Now, the
next question how can we control intent?
[9:32] We understand what it is. We understand what we
need to capture in order to control it. But then
[9:37] the next question, so how can we do that? Right?
So moving on to controlling intent. Controlling
[9:45] intent calls for a system that can first of all
capture all those signals. Remember identities,
[9:54] human, non-human, what they're trying to do, why
they're trying to do that. Now the flow of access.
[10:01] So capturing all those signals, understanding
them together and checking them against policies.
[10:11] Policies is the way to define our approved intent.
That is exactly runtime authorization. That's
[10:21] what's runtime that is what runtime authorization
is all about. It's a way to control intentbased
[10:29] access. Policies would define the approved
intent and policies would govern all those
[10:38] uh data elements I mentioned before in order
to provide the right controls. So if policies
[10:47] is the way to capture intent, to define intent
and to control intent, what's next? How can we
[10:56] enforce that? Right? That's the next question.
And that is exactly what runtime authorization
[11:02] is all about. Runtime authorization is the way
to take those welldefined policies and enforce
[11:10] them across the board. Enforce them whenever the
agent is trying to perform operations, access data
[11:19] or whatever. That is true runtime authorization.
and runtime authorization. What makes them runtime
[11:27] authorization is the ability to make decisions as
the agent acts. Not before, of course, not after,
[11:38] but it's not predetermined. It's not static.
It's being evaluated continuously throughout the
[11:46] process. That is the true runtime authorization.
And at each and every step we evaluate what is
[11:54] the intent and does it is is the intent aligned
with the defined policies. Okay. Now I'm I I
[12:04] mentioned the way to capture intent by policies.
So we have our policies how we enforce by runtime
[12:12] authorization. And the next question is how can
we or what are the right control places in the
[12:20] identic flow. So what I would like to do now is
to review a sample identic flow and talk about the
[12:28] control points which you should consider in order
to enforce that intent. Okay. So this represents a
[12:38] highlevel um uh flow of a typical uh structure.
Okay, it all it always starts with a prompt.
[12:48] The prompt is where we are asking questions or
asking to do an operation. Then it goes through
[12:55] a data retrieval process maybe a usage of MCP and
then there is a response. The first control point
[13:04] is at the prompt. Can I ask any question? The
answer should be obviously no. Nobody can ask
[13:11] our questions, right? And why is that control
point important? Because you can block the flow
[13:21] before it even reaches data before it even uses
any tools. Block the flow right at the beginning.
[13:29] As an example, let's say I have a support
agent. So, if I'm using a support agent,
[13:37] should I be able to ask financial questions or
human resource questions? No, I shouldn't. Right?
[13:44] I want to block the flow right at the beginning.
So, controlling the prompt is important. Now,
[13:51] probably many of you have heard about guardrails,
input guardrails. Now guardrails up until now was
[14:00] primarily referred to operational guardrails. What
I'm saying it's not sufficient. It's not enough.
[14:07] You should also consider adding to your guardrails
the authorization part, the security part,
[14:15] the intent of the agent. It's not just whether
the question, the prompt is appropriate. It's
[14:24] also if it is authorized and that would be your
first control point input guardrails. The second
[14:33] control point are the data guardrails, right? Data
guardrails would control what can be used in the
[14:42] flow. Now obviously agents are accessing they are
designed to access huge amounts of data. whatever
[14:50] you have. I guess many of you have already enabled
your local agents to access your Google Drive and
[14:58] um emails and whatever, right? And think about
that in an organizational level when agents can
[15:05] access the organizational data that calls for
a huge uh option for exposure and we don't want
[15:13] that, right? So, we need to control what data the
agents can use. Remember it's always in context.
[15:20] A human is operating an agent or an agent is
operating an agent. Why are they pulling that
[15:26] data now? Or maybe let's control what data can be
pulled. So only the records from the US not from
[15:35] Europe only sensitive or in not sensitive data. We
can control what data is even fed into theic flow.
[15:44] The agent doesn't need all the data. it can access
per specific flow. It needs only what is relevant
[15:52] and that is one of the most important control
point. Doesn't really matter whether your data
[15:58] is in documents or your data is in structured
repositories whatever you need to apply those
[16:06] controls and the way to do that is by filtering
before retrieval not after of course before
[16:14] retrieval. apply pre- retrieval data controls,
but data is also accessible by tools, right? MCP
[16:23] probably one of the most known standards in this
conference at least. So, it's a way for agents
[16:30] to access systems, to access tools, and also to
access data. So, whenever you think about MCP
[16:38] control, it's not only about whether an agent can
use a tool. That's basic. Everyone's doing that,
[16:46] right? It's also how the tool is being used,
right? If the agent can use a tool to send emails,
[16:53] can they use the tool to send emails outside the
organization? Can they send 100 emails at a single
[17:00] point of time? How they are using the tool?
What data is exposed by that tool usage? It's
[17:09] always about that level of granularity you need to
consider. Remember intent it's not just about the
[17:18] infrastructure the agent use is using. It's about
why the agent is doing what it's currently doing
[17:25] at a single point of time whether it's accessing
data or utilizing tools. And the last part here is
[17:33] the response. Even though we have controlled what
the agent can feed can fetch from data perspective
[17:41] in the response there might be sensitive data
PII maybe right and we want to mask that as
[17:48] well and that would be our fourth control point.
So considering the full agentic flow, we need to
[17:56] consider those four control points. Controlling
the input, the prompt, controlling the data,
[18:03] the MCP tools, and of course the output. All
of that by intent, our intentbased policies.
[18:14] So bottom line is uh we also need eventually
to govern uh to govern uh those policies to
[18:24] govern that access. And the only way this new
age of autonomy access can be governable is if
[18:35] we will control it by policies. Not by individual
assignments, not by static definitions, only by
[18:44] policies. Policies that capture intent, capture
approved intent and accordingly apply access.
[18:55] Erh so moving on to key takeaways because I'm out
of time. H those are my key takeaways. Erh, first
[19:03] of all, identic AI fails when we authorize actions
without intent. If we continue applying all those
[19:12] static definitions in order to approve what can
happen or not, then we are missing the point,
[19:19] right? We are not truly governing governing
and controlling the agentic access. Second,
[19:26] permissions. Remember, you all have permissions.
They say what is possible not what is appropriate.
[19:33] So they are not really sufficient. They are the
beginning of the secured controls but they are
[19:38] not controlling the end. Constraint purpose
not just the tools why agent is trying to
[19:46] use the tool not just that it can use it. runtime
evaluation. That's the new erh technology or the
[19:55] new concept to truly govern those agentic flows.
And intent intent is what needs to be considered
[20:02] throughout the identic flow. Uh that's it. I'm
out of time. I'm Gal. Was very nice to speak to
[20:09] you. I'm happy to expand on any of those topics
if you wish. I'm at booth uh 10:45. Thank you.
