AI-agent security controls need proof, not just experienced hires

The OWASP AI Agent Security Cheat Sheet recommends limiting agents to the tools and permissions needed for a task, explicitly authorizing sensitive tool use and testing agent systems against adversarial scenarios. These are not optional refinements for a later stage. They are part of making an agent's access proportionate to its assignment.

The case for security does not require predicting that agents will cause a particular kind of harm. It follows from the authority a deployment grants them. The broader that authority, the more important it is to scope permissions, check sensitive actions and keep a record of the decisions made. Completing a workflow does not, by itself, show that an agent stayed within appropriate boundaries.

A team move is not a security result

On Tuesday, Temporal announced that Oso team members had joined to advance its AI-agent security work. Oso said most of its current team was joining Temporal, while Tiny acquired Oso Cloud. Oso said the cloud product would continue operating as usual.

The move brings authorization experience to Temporal's effort. But Temporal says the authorization work is still being developed, and the announcement does not change current product availability. The announcements provide no independent evaluation showing that the planned controls block unauthorized actions or preserve decisions reliably.

Temporal's strongest case is that its existing Durable Execution approach may help maintain workflow decisions. The company says the feature preserves workflow state and history through failures and retries, including approvals and rejections in agent workflows. If a workflow resumes after a failure, retaining a prior decision could matter.

But preserving a decision is not the same as making the right authorization decision. A control must identify whose authority applies and whether that authority covers the particular action. It also matters whether a connected service enforces the decision. A durable record may help explain what happened; it cannot alone establish that an agent had only the access it needed.

That is the strongest argument for seeing the deal as more than a staffing announcement: Temporal's workflow infrastructure could provide a foundation for consistent authorization, and the Oso team brings relevant experience. It is a credible direction, not proof of a result. Security should be judged by the controls delivered and how they behave, not by the credentials of the people tasked with building them.

Make the controls earn trust

The tests should answer concrete questions. Does a permission decision follow the right identity across each tool call? Does it remain effective when an agent delegates work or a workflow fails and retries? Can a connected service reject an action outside the agent's authority? Can an organization later trace an action to the agent and the authority behind it?

The National Institute of Standards and Technology's National Cybersecurity Center of Excellence has proposed work on applying identity and authorization practices to software and AI agents. Its concept paper identifies identity, delegation and auditability as areas to address, with practical guidance listed as a planned outcome. That underscores how much implementation remains to be worked through; it is neither a test of Temporal's approach nor an endorsement of it.

Temporal should explain which tools and actions its controls cover, how they handle identity and delegated work, and what happens when a workflow fails or a connected service applies a different decision. It should publish tests of unauthorized requests, retries and sensitive actions, plus records showing how actions link to identities and permissions. Independent evaluation would make those results more useful to customers, while clear design documentation would let them see what was tested and where the limits are.

Organizations deploying agents should ask for that evidence before relying on authorization for sensitive work. Temporal's move is a concrete step toward treating the problem seriously. The company should now deliver controls that withstand scrutiny, and give customers enough evidence to judge them.