Share

Runtime Control Walkthrough

What the Guardian Sees

By Sevda Polat— September 10, 2026

Feature image for article: What the Guardian Sees

The OWASP Agent Control Standard ships with two demo scenarios: an agent tries to delete a filesystem and gets blocked, and an agent asks for an entire database table and gets a narrower query back. Both look like the control system saying no, with the second saying it more politely. But refusing an action and rewriting one draw on different things. Refusal needs recognition. Rewriting needs a correct replacement, which means the system has to know something about what the agent should have asked for — and where that knowledge comes from is the whole architecture.

Runtime Control Walkthrough

What the Guardian Sees

By Sevda Polat— September 10, 2026

The OWASP Agent Control Standard ships with two demo scenarios: an agent tries to delete a filesystem and gets blocked, and an agent asks for an entire database table and gets a narrower query back. Both look like the control system saying no, with the second saying it more politely. But refusing an action and rewriting one draw on different things. Refusal needs recognition. Rewriting needs a correct replacement, which means the system has to know something about what the agent should have asked for — and where that knowledge comes from is the whole architecture.

Human Decision Limits

When Human Oversight Works Against You

By Sevda Polat— September 10, 2026

Feature image for article: When Human Oversight Works Against You

Adding a human checkpoint to an agent workflow feels like adding safety. But a meta-analysis of 106 experiments found that human-AI teams performed worse than the better solo performer on decision tasks, and in more than 95% of those setups the human held the final call. Research on clinical alerts and security warnings deepens the problem: review accuracy falls sharply under repetition, and production agent queues manufacture repetition by design. Most teams have never tested whether their approval gates are still functioning as judgment.

Human Decision Limits

When Human Oversight Works Against You

By Sevda Polat— September 10, 2026

Adding a human checkpoint to an agent workflow feels like adding safety. But a meta-analysis of 106 experiments found that human-AI teams performed worse than the better solo performer on decision tasks, and in more than 95% of those setups the human held the final call. Research on clinical alerts and security warnings deepens the problem: review accuracy falls sharply under repetition, and production agent queues manufacture repetition by design. Most teams have never tested whether their approval gates are still functioning as judgment.

Decision Architecture Reading

Unsanctioned Agent Behaviour During Cyber Testing

AISI's incident report shows environment design, not model capability, determined whether agents went off-script.

When Combinations of Humans and AI Are Useful

Across 106 studies, human-AI teams performed worse on average than whichever worked better alone.

Why Agentic AI Needs a Strong Identity Foundation

OWASP Agent Control Standard

Characterizing Agents in Production

MCP Tasks Extension: Cancellation Semantics

Decision Architecture Reading

Unsanctioned Agent Behaviour During Cyber TestingAISI's incident report shows environment design, not model capability, determined whether agents went off-script.

When Combinations of Humans and AI Are UsefulAcross 106 studies, human-AI teams performed worse on average than whichever worked better alone.

Quick links

Why Agentic AI Needs a Strong Identity Foundation

OWASP Agent Control Standard

Characterizing Agents in Production

MCP Tasks Extension: Cancellation Semantics

Guardian Decision Vocabulary

The OWASP Agent Control Standard (v0.1.0) places a Guardian between an agent and its tools, and gives that Guardian exactly five words to work with: ALLOW, DENY, MODIFY, ASK, and DEFER. Each carries specific structural requirements, mandatory fields, and constraints on how the agent handles the response.

What makes this vocabulary worth walking through carefully is where each decision stops. An ALLOW clears the action but can't verify what happens downstream. A DENY blocks it but prescribes no cleanup for work already in progress. And when the Guardian goes silent entirely, the spec's default is to let the action through. Here's the practical breakdown, decision by decision.

Guardian Decision Vocabulary

The OWASP Agent Control Standard (v0.1.0) places a Guardian between an agent and its tools, and gives that Guardian exactly five words to work with: ALLOW, DENY, MODIFY, ASK, and DEFER. Each carries specific structural requirements, mandatory fields, and constraints on how the agent handles the response.

What makes this vocabulary worth walking through carefully is where each decision stops. An ALLOW clears the action but can't verify what happens downstream. A DENY blocks it but prescribes no cleanup for work already in progress. And when the Guardian goes silent entirely, the spec's default is to let the action through. Here's the practical breakdown, decision by decision.

Allow Decision

ALLOW Lets the Action Through Without Changes

The Guardian has checked identity, capability, scope, and provenance, and everything passes. The agent executes the action as submitted. Reasoning is optional. One gap worth noting: ALLOW governs what leaves the wire, not how the downstream application actually interprets the payload.

Deny Decision

DENY Blocks the Action With No Fallback

The agent cannot dispatch the tool call, send the message, or perform the activation. Reasoning is mandatory, and policy references identify which rules triggered the block. What DENY doesn't address: prior steps in a multi-step task may already have completed, leaving work partially committed with no prescribed cleanup.

Modify Decision

MODIFY Rewrites the Payload Before Execution Continues

The Guardian alters the action through wholesale replacement or structured edits (redactions and parameter overrides), but never both at once. If the modifications object breaks composition rules by overlapping targets between redactions and overrides, the agent must treat the whole thing as a DENY and fail closed.

Ask Decision

ASK Pauses Execution and Requests External Approval

When an action falls outside what policy can resolve automatically, ASK suspends it and routes to a human, another agent, or a service. Approvers can widen the session's intent scope for a single request or permanently. If the client can't handle approval flows, the Guardian substitutes DENY.