AI Reasoning Needs an Enforcement Boundary

We cannot automate the status quo and call it transformation

The cybersecurity community increasingly acknowledges that status quo security will not be enough for what is coming. We talk about upgrading or replacing existing systems, enforcing least privilege, strengthening access controls, and building genuine defense in depth.

I agree completely. But then we need to actually do it.

AI can make detection dramatically better. It can investigate an alert in seconds instead of hours, correlate information across systems, reconstruct attacks, recommend remediation, and automate responses that previously required an analyst.

Those are enormous improvements, but they do not eliminate the underlying architectural question: why are we allowing so much potentially dangerous activity to execute first and asking increasingly sophisticated systems to determine what happened afterward?

Least privilege should not stop at identities, accounts, network access, agent permissions, or orchestration policies. It should extend all the way to execution itself.

If an unknown executable, suspicious script, malicious command line, abused LOLBin, or component of an attack does not need to execute, preventing that execution upstream is fundamentally different from detecting and responding to it downstream.

That difference matters.

Zero-trust should not end where AI autonomy begins

Zero-trust is built around a simple principle: trust should not be granted merely because something appears to come from a trusted place.

We apply that principle to users, identities, devices, networks, applications, and access requests. As autonomous AI systems gain increasingly consequential authority, the same principle should apply to them.

An authenticated agent is not necessarily a correct agent. An authorized agent is not necessarily an uncompromised agent. A highly capable model is not an infallible model, and an instruction arriving through a trusted orchestration platform does not automatically make the resulting executable action safe.

This is where Zero-Trust Execution differs from the broader way the term “zero-trust” is commonly used.

Zero-Trust Execution means that software, scripts, command lines, and other executable actions are not trusted merely because they originate from an authenticated user, an approved network, a signed publisher, a trusted application, an AI agent, or an authorized orchestration platform.

Execution itself remains a separately governed decision.

That distinction creates another independent security boundary between reasoning and action.

Autonomous security needs independent enforcement

Agentic SOC platforms are becoming increasingly sophisticated at understanding what is happening and deciding what to do about it. That is a major advancement, but autonomous response can also create real consequences when a decision is wrong.

The wrong account can be disabled, the wrong endpoint can be isolated, the wrong production process can be terminated, and a mistaken or manipulated agent with broad authority can potentially create substantial operational disruption.

The answer is not to slow AI down or require humans to approve every decision. The answer is to design architectures where AI can move quickly while consequential actions remain governed by strong, independent controls.

In fact, an independent enforcement boundary can make greater AI autonomy safer. By preventing a model or orchestration layer from automatically becoming the final authority over execution, additional policy, context, and human judgment can remain available when uncertainty or consequence warrants it.

The goal is not to constrain AI unnecessarily. It is to give AI greater freedom to reason and operate without giving any single reasoning system unrestricted authority over what ultimately occurs on the endpoint.

The endpoint needs a Zero-Trust Execution Layer

For approximately fifteen years, I have been developing a Windows endpoint security platform called CyberLock.

CyberLock was not designed for Agentic SOC. Agentic SOC did not exist when the work began.

Instead, CyberLock gradually evolved around a deceptively simple question:

Should this action be allowed to execute right now?

Answering that question well required solving many of the same problems the industry is now confronting with autonomous AI.

Traditional allowlisting was too rigid. Static policies created too much administrative friction. Digital signatures provided valuable identity information but could not be treated as proof of innocence. Scripts, command lines, LOLBins, fileless attacks, and multi-stage attacks required contextual understanding rather than simple file reputation.

As machine learning and later large language models became useful, they added powerful analytical capabilities, but they still could not simply be handed unrestricted authority.

Over time, the architecture evolved into what I now believe is a natural fit for the Agentic SOC:

CyberLock can automate high-confidence decisions, apply contextual analysis, use AI as another source of reasoning, and involve a human when uncertainty or consequence warrants it.

Because execution remains independently governed at the endpoint, a mistaken, manipulated, or compromised AI agent does not automatically become an unrestricted execution authority.

Human-in-the-loop should not mean human-in-every-loop. High-confidence decisions can be automated while meaningful human authority is preserved when uncertainty, consequence, or business context warrants it.

The Agentic SOC is missing a fourth question

Most Agentic SOC architectures revolve around three fundamental questions:

1. What is happening?
2. What does it mean?
3. What should we do about it?

There is a fourth question we should be asking:

That question should not belong exclusively to the AI agent.

A model can reason, an orchestration platform can coordinate, and an agent can recommend or initiate action, but the endpoint should still have its own enforcement boundary governing what actually executes.

This creates defense in depth for autonomous systems. The AI reasons and investigates, the orchestration layer coordinates action, the endpoint enforcement layer controls execution, and human judgment remains available when confidence, business context, or consequence makes it appropriate.

That architecture allows AI to become more autonomous without requiring us to blindly trust every autonomous decision.

Prevention should happen before investigation whenever possible

Modern cybersecurity necessarily spends enormous resources detecting, investigating, and responding to activity after it has begun. Those capabilities are essential, but there is another question worth asking:

How much downstream work could be avoided if unwanted execution were prevented upstream?

If an unknown executable, malicious script, suspicious command line, LOLBin abuse, or component of an attack can be stopped before it executes, the SOC may never need to investigate the incident that would otherwise follow.

That becomes even more important in an Agentic SOC because every unnecessary alert consumes reasoning, compute, orchestration, and ultimately human attention. Better execution control can improve the signal reaching everything downstream.

CyberLock is therefore not intended to replace EDR, NDR, SIEM, MDR, or Agentic SOC platforms. Its role is narrower and complementary:

The industry should define this boundary now

As AI systems gain the ability to take increasingly consequential security actions, the cybersecurity community should be asking difficult questions before these architectures become deeply entrenched.

How much authority should an AI agent have over an endpoint? Which actions should be fully autonomous? Which decisions should require independent verification? When should human approval remain necessary? How should an endpoint distinguish between legitimate autonomous action and a compromised, mistaken, or manipulated agent?

And perhaps most importantly:

Should the same AI system that decides an action is safe also be the final authority that permits it to execute?

The answer should not automatically be yes.

CyberLock represents one practical implementation of an independent Zero-Trust Execution boundary, developed long before Agentic SOC became an industry category. I have an obvious interest in this discussion because I spent approximately fifteen years building it, but the architectural question is much bigger than CyberLock, and the argument does not depend on any one product being the answer.

There will be other approaches, and there should be. What matters is that we recognize the requirement.

If we truly believe status quo security will not be enough, then we should not merely attach increasingly capable AI to the status quo and declare the problem solved. We should use this moment to strengthen the underlying security architecture itself through least privilege, defense in depth, strong independent enforcement boundaries, and prevention wherever prevention is possible.

As AI becomes increasingly capable of deciding what should happen inside our environments, we need equally strong controls governing what those systems — and everything else — are actually allowed to make happen.

The future SOC will require extraordinary intelligence, but intelligence without boundaries is not zero-trust.

AI can reason, investigate, recommend, and increasingly act. Consequential endpoint execution should still be governed by a security boundary designed specifically for that purpose.

If you want to challenge the architecture, pressure-test CyberLock, or explore how independent execution enforcement could integrate with an autonomous security platform, I would genuinely like to hear from you. You can reach me through cyberlock.global.

Whether CyberLock ultimately represents one implementation of this architecture or inspires better ones is less important than addressing the underlying question. As we build increasingly intelligent autonomous defenders, we should make sure we are also building the boundaries that make their autonomy safe.

Alongside What is happening? What does it mean? What should we do about it?, the Agentic SOC should always ask one more question:

What is actually permitted to execute?

Open letter drafted collaboratively with ChatGPT, with additional review from Claude and Gemini.