When AI Becomes a Workforce, SABSA’s Risk Model Inverts

The Most Privileged Insider

An agent workforce turns that model inside out.

The agent is not outside the boundary. It is your most privileged insider: authenticated, authorized, and granted access to the data and tools it needs to do real work. And it can be turned against you without a single control being breached, because the attack does not arrive through the perimeter. It rides in on the very input the agent exists to process.

Security researcher Simon Willison named this the lethal trifecta: give an agent access to sensitive data, expose it to untrusted content, and let it communicate outward, and you have built an insider that can be instructed by a stranger. None of those three capabilities is a misconfiguration. Each one is the job description. Remove any leg and the agent stops being useful.

Authorized Is Not Safe

Authorization tells you who the agent is. It tells you nothing about what the agent can be talked into doing.

That is the inversion. SABSA can model an insider threat and can grade trust domain by domain — but every control it reasons about still resolves to a question of access: who is authorized to touch what, at what trust level. An agent defeats that frame without breaching any of it. It is authorized, correctly, for exactly what its job needs — and then manipulated, through the very input it exists to process, into using that authorization against you. The threat has moved below the access boundary, into behavior, where an access-control model has no native layer to stand on. The most trusted actor inside the boundary is now the least predictable one, and "authorized" has quietly stopped meaning "safe."

You Cannot Tighten Your Way Out

You cannot tighten your way out of it. The instinct is to clamp down on access, but access is not the failure. A fully authenticated, fully authorized agent, doing exactly what its permissions allow, is the attack surface. The failure lives one layer below access, in behavior: what a trusted worker is induced to do with authority it legitimately holds. SABSA controls the door. It has no layer for the badge-holder who was talked into walking the wrong file out.

Enforcement Moves to the Moment of Behavior

So security architecture has to add what SABSA never needed. The question moves from "is this actor allowed in" to "is this action, on this input, right now, inside the bounds of what this worker should be doing at all." Enforcement shifts from the moment of authentication to the moment of behavior.

This is already taking shape, not theory. For example, an AI gateway sits in the inference path between the agent and the models and tools it calls, governing what the agent is about to do rather than only whether it was allowed to connect. It inspects, constrains, and records behavior at runtime. That is a control layer the old security architecture did not have, because until now the enterprise never had to govern an insider whose loyalty was conditional on its last input.

The Badge Is Already Issued

SABSA secured the building by controlling the doors. The agent already has a badge. The question now is not who gets in, but what a trusted worker can be persuaded to do once inside.

The Bridge to Part 3

About This Series

Cite the Position Paper

@misc{saleme2026eaa,
  author    = {Saleme, Michael K.},
  title     = {Enterprise Agent Architecture: The Case for a Fifth Architecture Domain for the Agentic Enterprise},
  year      = {2026},
  publisher = {Zenodo},
  doi       = {10.5281/zenodo.21105314},
  url       = {https://doi.org/10.5281/zenodo.21105314}
}