Standing credentials
Keys and service accounts issued once and used indefinitely, often outside normal joiner and leaver process.
IdentitySystems and access
AI systems act on their own. Their access should still be bounded.
An AI system or agent inherits whatever it is connected to. Once it holds standing credentials and a permanent route into your data and tooling, its reach is only as small as the last configuration change. Physical Control puts the boundary somewhere an agent cannot rewrite.
- Agent and model access
- Standing credentials
- Bounded windows
- Recorded activity
The connection state today
Permanent, credentialed and wide
AccessStanding API keys and service accounts
ScopeWhatever the integration was granted
DurationUntil someone revokes it
EvidenceApplication logs, if retained
Need → Control → Blueprint → Modules
01What is exposed
The reach of an agent is rarely the reach that was intended
AI systems are connected to make them useful. The exposure comes from what remains connected after the useful work has finished.
Wide data reach
An agent given access to a share or system can usually read far more of it than the task required.
DataTool and action rights
Agents that can act, not just read, can change systems at machine speed and without a person in the loop.
ActionPrompt-driven behaviour
Instructions can arrive inside the content an agent processes, so intended limits are not always the limits that apply.
BehaviourWeak evidence
When something goes wrong, the record of what the agent reached is frequently incomplete.
AuditModel and training material
Proprietary models, weights and curated training sets sit online with the same reach as ordinary files.
Assets02Why the exposure exists
Agents are integrated quickly and reviewed slowly
The pace of adoption is the point. The consequence is that access is granted to get something working, then inherited by everything that follows.
The pattern
Convenience becomes permanence
Nobody decides that an agent should hold indefinite access to a production system. It happens because the credential worked and nothing forced it to expire.
Control the path, protect the asset.Pilots become production
Access granted for an experiment is rarely reissued when the experiment becomes a dependency.
Scope is hard to express
Most systems grant access at the level of a share, a database or an account, not the level of a task.
Autonomy outpaces review
An agent can take thousands of actions between the change control meetings meant to govern it.
Ownership is unclear
AI integrations often sit between engineering, data and the business, so no one holds the access register.
03Which paths need controlling
Name the routes an agent can take
Control starts by writing down the specific paths between AI systems and the systems and data they reach.
The path or relationshipWho uses itHow it behaves todayWhat Control governs
Agent to production dataInternal AI platformStanding service accountWindow opened for a named purpose, then closed
Agent to external model APIThird-party providerAlways-on egressDefined route, approved destinations, recorded transfers
Agent to tooling and actionsAutomation layerBroad permissionsValidated requests with revocation on signal
Model and training assetsData scienceLive sharesHeld offline and brought back for the work
Human oversight routeNamed ownersAd hocOut-of-band approval and an evidenced trail
The list matters more than the technology. Once the paths are written down, the governance question becomes concrete.
04What physical Control changes
The boundary sits outside the software the agent runs on
Physical Control does not attempt to reason about intent. It governs whether a route exists at all.
Before
Access is configured and trusted to stay configured.
- •Credentials persist until someone removes them
- •Reach is defined inside the application
- •Revocation depends on the system responding
- •Evidence is scattered across logs
After
Access exists only inside a window that has been opened.
- ✓No standing path between runs
- ✓Windows opened for a named purpose and owner
- ✓Revocation enforced at the physical layer
- ✓Every window recorded as evidence
An agent cannot exceed a connection that is not there.Connected when approved. Disconnected by default.
05The Firevault principle
Control is physical, or it is only a policy
Software can be told to deny a connection. Physical Control removes the connection itself, so the denial does not depend on the system behaving as configured.
Start with the path, not the tool
Every incident that spreads does so along a connection that was already there. Control begins by naming that connection in plain language, before anyone talks about products.
Make the default state disconnected
A path that exists only when it is needed cannot be used at three in the morning by someone who should not have it. Disconnection is the resting state, not the emergency response.
Open on approval, close on schedule
When work genuinely needs a connection, Control opens it for a named person, a stated purpose and a fixed period, then closes it again without anyone having to remember.
Prove it physically, not on paper
A policy says the path should be closed. Physical control shows that it is. That difference is what auditors, insurers and boards are actually asking about.
How this fits together
Your need sets the direction. Control sets the rule. The Blueprint sets the architecture.
NeedControlBlueprintModules and Firebreak
06Where this is designed
The Blueprint for this need is CP-03 Control Third-Party Access
Governing AI access uses the same architecture as third-party access, with compliance evidence alongside it.
Control Third-Party Access
Give third parties access without giving them a permanent doorway.
Applied to time-bounded vendor and supplier access. The Blueprint page carries the architecture, the zone detail and the deployment sequence.
What you get from the Blueprint that this page does not cover
- ✓It shows how a request is validated before any route opens
- ✓It sets out time-bound windows instead of standing credentials
- ✓It defines the evidence trail an auditor or regulator will ask for
Also relevant · CP-06
A different job
Prove Compliance Through Control
Compliance becomes stronger when control can be demonstrated, not just documented.
Open CP-06 Also relevantAI Control Blueprints
AI access patterns are set out in the AI Control Blueprints playbook, which covers agent access, tooling rights and oversight in more depth than a single numbered Blueprint.
Open the playbookThis page is about the routes an AI system can take. Protecting the models, weights and training material themselves is a different job, and Offline Secure Storage holds those copies physically outside the connected environment.
Protect models and training data offlineQuestions
What teams ask about AI access
The practical questions that come up once agents move from pilot to production.
No. It changes when the connection exists. The work still happens, inside a window opened for a named purpose that closes afterwards.
Need → Control → Blueprint
Name what the agent can reach. Then bound it.
The AI Control Blueprints show how agent access is validated, time-bound and evidenced without slowing the work down.