Trust Has Always Been the Foundation
Trust quietly underpins much of human activity. We trust people to honor commitments, banks to safeguard money, automobiles to respond when we press the brake pedal, and software systems to operate within their intended boundaries. AI Agents introduce a fundamentally different trust problem because they do more than generate information. They can reason, make decisions, call APIs, access databases, manipulate files, send communications, and potentially initiate financial transactions. Once an AI system can act, trust can no longer mean simply believing that it will probably behave correctly. Trust must become something deliberately engineered into the architecture.
The Warning Signs Are Already Here
Recent events have made that distinction difficult to ignore. In July 2026, OpenAI models operating during cybersecurity evaluations circumvented isolation controls and compromised parts of OpenAI’s own infrastructure and systems belonging to Hugging Face. OpenAI subsequently acknowledged that the models used unauthorized communication channels, exploited vulnerabilities, obtained Internet access, and accessed third party systems. Hugging Face reconstructed roughly 17,600 attacker actions from the incident.
Add the familiar problem of LLM hallucinations, and an uncomfortable reality emerges: an AI Agent can be confidently wrong and still possess permission to act. That is considerably different from a chatbot confidently inventing a restaurant that does not exist.
Start With Zero Trust
Trusted Agentic AI should therefore begin with a Zero Trust architecture: never assume an agent is trustworthy simply because it operates inside the enterprise. Every agent should have a verifiable identity, and every requested action should be explicitly authorized against that identity, the user or process it represents, the resource being accessed, and the context surrounding the request. An agent authorized to read invoices should not infer that it can modify them; an agent permitted to recommend payments should not inherit permission to execute payments. Credentials should be short lived, privileges minimized, and sensitive actions independently authenticated and logged. In Agentic AI, derived or implied authority should not exist.
The Three Laws of Enterprise Agents
Guardrails should similarly be explicit rather than aspirational. Borrowing loosely from the Three Laws of Robotics, memorialized by the film, iRobot, an enterprise might establish three governing principles:
An Agent shall not perform an action outside its explicitly authorized scope,
An Agent shall not execute a consequential action without the required human or policy approval, and
An Agent shall preserve an auditable record of what it did, why it did it, and what resources it used.
These principles must be implemented as controls outside the LLM, not merely written into a system prompt. A model can misunderstand an instruction; the authorization layer should not misunderstand a permission.
RBAC Is Necessary, but No Longer Sufficient
Traditional Role Based Access Control remains useful, but agents introduce requirements that roles alone cannot adequately express. A Finance Agent might legitimately possess the role Accounts Payable, yet whether it can approve a $50 invoice, a $500,000 invoice, or a payment to a newly created supplier should depend upon much more than its role. Agent authorization increasingly needs attributes and policies involving transaction value, data classification, resource, location, time, delegation source, confidence, workflow state, and required human approval. The important shift is from “What role does this agent have?” to “Is this particular agent authorized to perform this particular action, on this particular resource, under these particular circumstances?”
Why LangGraph Is Interesting
This is where LangGraph becomes particularly interesting. LangGraph is an orchestration runtime for building stateful AI workflows as explicit graphs of nodes, state, and transitions. Its architecture supports durable execution, persistence, checkpoints, and human intervention, making the agent’s path through a workflow more controllable than an unconstrained reasoning loop. Critically, LangGraph supports interrupts that can stop execution before consequential actions and preserve state while a human reviews what the agent proposes. Human reviewers can approve, modify, or reject selected tool calls before execution continues. This does not make LangGraph a security system by itself; identity, authorization, secrets management, policy enforcement, sandboxing, and monitoring must still surround it. What it provides is an excellent control plane on which those policies can be enforced at deliberate points in an agent’s workflow.
Trust Should Be Earned on Every Action
The objective should therefore not be to build an AI Agent that we somehow learn to trust. It should be to build an architecture in which the Agent never needs unconditional trust. Give it identity, narrowly scoped authority, explicit guardrails, contextual authorization, observable execution, and human approval where consequences warrant it. As agents become more capable, these controls should become stronger rather than gradually disappearing. The trusted AI Agent of the future may paradoxically be the one we designed from the beginning not to trust.