Control need · AI systems and infrastructure

AI systems act on their own. Their access should still be bounded.

An AI system or agent inherits whatever it is connected to. Once it holds standing credentials and a permanent route into your data and tooling, its reach is only as small as the last configuration change. Physical Control puts the boundary somewhere an agent cannot rewrite.

See what Control changes What is Control

As featured in

What is exposed

The reach of an agent is rarely the reach that was intended.

AI systems are connected to make them useful. The exposure comes from what remains connected after the useful work has finished.

Identity

Standing credentials

Keys and service accounts issued once and used indefinitely, often outside normal joiner and leaver process.

Data

Wide data reach

An agent given access to a share or system can usually read far more of it than the task required.

Action

Tool and action rights

Agents that can act, not just read, can change systems at machine speed and without a person in the loop.

Behaviour

Prompt-driven behaviour

Instructions can arrive inside the content an agent processes, so intended limits are not always the limits that apply.

Audit

Weak evidence

When something goes wrong, the record of what the agent reached is frequently incomplete.

Assets

Model and training material

Proprietary models, weights and curated training sets sit online with the same reach as ordinary files.

Why the exposure exists

Agents are integrated quickly and reviewed slowly.

The pace of adoption is the point. The consequence is that access is granted to get something working, then inherited by everything that follows.

The honest position

Convenience becomes permanence.

Nobody decides that an agent should hold indefinite access to a production system. It happens because the credential worked and nothing forced it to expire.

Control the path, protect the asset.

Pilots become productionAccess granted for an experiment is rarely reissued when the experiment becomes a dependency.
Scope is hard to expressMost systems grant access at the level of a share, a database or an account, not the level of a task.
Autonomy outpaces reviewAn agent can take thousands of actions between the change control meetings meant to govern it.
Ownership is unclearAI integrations often sit between engineering, data and the business, so no one holds the access register.

Which paths need controlling

Name the routes an agent can take.

Control starts by writing down the specific paths between AI systems and the systems and data they reach. Switch between today and with Control.

Agent to production data

Who uses itInternal AI platform

How it behaves todayStanding service accountWhat Control governsWindow opened for a named purpose, then closed
Agent to external model API

Who uses itThird-party provider

How it behaves todayAlways-on egressWhat Control governsDefined route, approved destinations, recorded transfers
Agent to tooling and actions

Who uses itAutomation layer

How it behaves todayBroad permissionsWhat Control governsValidated requests with revocation on signal
Model and training assets

Who uses itData science

How it behaves todayLive sharesWhat Control governsHeld offline and brought back for the work
Human oversight route

Who uses itNamed owners

How it behaves todayAd hocWhat Control governsOut-of-band approval and an evidenced trail

The list matters more than the technology. Once the paths are written down, the governance question becomes concrete.

What physical Control changes

The boundary sits outside the software the agent runs on.

Physical Control does not attempt to reason about intent. It governs whether a route exists at all.

Today

Configured access

Access is configured and trusted to stay configured.

Credentials persist until someone removes them
Reach is defined inside the application
Revocation depends on the system responding
Evidence is scattered across logs

With Control

Windowed access

Access exists only inside a window that has been opened.

No standing path between runs
Windows opened for a named purpose and owner
Revocation enforced at the physical layer
Every window recorded as evidence

An agent cannot exceed a connection that is not there.Connected when approved. Disconnected by default.

The Control philosophy

Control the path, protect the asset.

Control is physical, or it is only a policy. Software can be told to deny a connection. Physical Control removes the connection itself, so the denial does not depend on the system behaving as configured.

1
Start with the path, not the tool

Every incident that spreads does so along a connection that was already there. Control begins by naming that connection in plain language, before anyone talks about products.
2
Make the default state disconnected

A path that exists only when it is needed cannot be used at three in the morning by someone who should not have it. Disconnection is the resting state, not the emergency response.
3
Open on approval, close on schedule

When work genuinely needs a connection, Control opens it for a named person, a stated purpose and a fixed period, then closes it again without anyone having to remember.
4
Prove it physically, not on paper

A policy says the path should be closed. Physical control shows that it is. That difference is what auditors, insurers and boards are actually asking about.

NeedSets the direction
ControlSets the rule
BlueprintSets the architecture
Modules and Firebreak®Implement it

Where this goes next

The Blueprint for this need is CP-08 Control AI Systems.

CP-08 is the AI Control Blueprint for consequential AI systems. It holds the runtime apart from the tooling it can act on, and uses the physical Firebreak hardware device as an AI kill switch that does not depend on the model or its orchestration responding.

CP-08 Control AI Systems

Bound what an AI system can reach, and keep a physical stop that does not rely on the model.

Open Blueprint CP-08 Compare all Blueprints

What the Blueprint adds

It severs the standing route between the AI runtime and production by default
It validates each request against identity, purpose and authority before anything opens
It grants reach as a time-bound window instead of a standing credential
It holds a hard stop that is enforced at the physical layer, not requested in software
It preserves the record of every window for an auditor or regulator

Also relevant: CP-03 Control Third-Party Access

Give third parties access without giving them a permanent doorway.

Open CP-03

Vault product icon A different job

This page is about the routes an AI system can take. Protecting the models, weights and training material themselves is a different job, and Offline Secure Storage holds those copies physically outside the connected environment.

Protect models and training data offline

Lead module

FV-Firebreak

Physically opens or closes connection paths to prevent unauthorised access and stop attack progression.

Read FV-Firebreak

Lead module

FV-Validate

Checks whether a request, command or approval should proceed before access, action or transfer is allowed.

Read FV-Validate

Lead module

FV-Execute

Initiates control actions when a policy, approval, schedule, incident state or supervisory override requires it.

Read FV-Execute

Lead module

FV-Isolate

Separates systems and networks into controlled zones to reduce lateral movement and enforce trust boundaries.

Read FV-Isolate

Lead module

FV-Relay

Allows connectivity only when needed, for a defined purpose, under controlled conditions and for a limited time.

Read FV-Relay

Questions

What teams ask about ai systems

No. It changes when the connection exists. The work still happens, inside a window opened for a named purpose that closes afterwards.

Identity is part of it: each request is validated against identity, purpose and authority before anything opens. The difference is that revocation is enforced at the physical layer, so it does not depend on the system responding.

The route to an external model API becomes a defined route, with approved destinations and recorded transfers, rather than always-on egress.

Protecting models, weights and training material is a different job. Offline Secure Storage holds those copies physically outside the connected environment, and brings them back for the work.

All questions

Name what the agent can reach. Then bound it.

The AI Control Blueprints show how agent access is validated, time-bound and evidenced without slowing the work down.

Open Blueprint CP-08 Talk to a member of the team Read the AI Control Blueprints playbook

Open CP-08 What changes

AI systems act on their own. Their access should still be bounded.

The reach of an agent is rarely the reach that was intended.

Standing credentials

Wide data reach

Tool and action rights

Prompt-driven behaviour

Weak evidence

Model and training material

Agents are integrated quickly and reviewed slowly.

Convenience becomes permanence.

Name the routes an agent can take.

Agent to production data

Agent to external model API

Agent to tooling and actions

Model and training assets

Human oversight route

The boundary sits outside the software the agent runs on.

Configured access

Windowed access

Control the path, protect the asset.

Start with the path, not the tool

Make the default state disconnected

Open on approval, close on schedule

Prove it physically, not on paper

The Blueprint for this need is CP-08 Control AI Systems.

FV-Firebreak

FV-Validate

FV-Execute

FV-Isolate

FV-Relay

What teams ask about ai systems

Name what the agent can reach. Then bound it.