This chapter serves the activity of securing the agent itself: giving it an identity of its own, issuing it credentials that cannot be kept, bounding what it can call and reach, and treating the estate in which the operator's AI runs as the most privileged workload there is. Its tools are of three kinds. The artefacts are records and manifests in version control that an agent cannot write: the agent identity record, the credential profile, the permission manifest, the containment profile, the tool registry entry, the containment catalogue and the Tier 0 checklists. The methods are short procedures for designing and testing them. The third-party tools are open standards and open-source software that the series names as the plumbing of agents: the Model Context Protocol, SPIFFE, OAuth 2.0 token exchange, the Agent2Agent protocol, Agent Skills, and the permission settings of coding agents. They come from AI Governance (2, Nordqvist, 2026), AI Platform and Security (3, Nordqvist, 2026), AI Red Team (4, Nordqvist, 2026), The Transformed Security Architect (6, Nordqvist, 2026), AI Boss (7, Nordqvist, 2026), AI Blue (8, Nordqvist, 2026), AI Purple (9, Nordqvist, 2026) and AI Operations (10, Nordqvist, 2026), with one tool from Architecture as Code (1, Nordqvist, 2025).
Two questions organise it: which identity and protocol standards do agents rely on, and which controls make the operator's AI Tier 0. The series' answer to the second is a design stance, not a product. A Tier 0 asset is one whose compromise gives control over the estate; AI Operations, Chapter 18, argues that an operations agent with write access to production, its runbook library, its observability pipeline and the control plane behind it are Tier 0 because the broadest credentials and the best map of the organisation meet there, and because what AI adds is a reader that cannot by its own judgement separate the data in a ticket from the instructions in it (10, Nordqvist, 2026). The controls that follow are designed for the agent's reach and not its intent, a conclusion of AI Platform and Security, Chapter 19: the same control bounds an agent steered by text, one whose model the provider updated without notice, and a script run with wrong parameters (3, Nordqvist, 2026). The Five Eyes agencies' guidance, as AI Operations cites it, states that the privileges assigned to an agent directly determine the risk it can introduce and recommends constructing each agent as a distinct principal with its own cryptographically anchored identity (254, Five Eyes agencies, 2026). Chapter 19 treated the tools that test whether these bounds hold; Chapter 18 treated the mandates that say what an agent may do. This chapter treats the records and standards that make the bounds enforceable.
The slice holds 58 inventory entries: 29 artefacts, 9 methods and 20 third-party tools and standards. The chapter treats 47 of them and lists the other 11 for reassignment in data/findings/chapter_20.md. Appendix A holds all 58.
Primary topics explored
- Agent identity and workload identity
- Credentials and secrets
- Agent protocols
- Containment and permission manifests
- What this repository is
- Checks
About Tools
Tools is a companion to The Transformed Architecture. It collects the tools that Books 1 to 10 describe in one reference, organised by what the practitioner is doing: artefacts (templates, manifests, records), own tools, third-party tools and standards, and methods. Each entry says what a tool is for, when to use it, what it needs and produces, and where the book that defines it explains the reasoning. The book covers choosing, adopting and retiring tools, architecture and delivery, governing AI, securing and testing, operating, agents and autonomy, and people, organisation and society, for European enterprises and public authorities. It comes with a template library, an inventory, three web tools and the Toolbox Maturity Method.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect, AI Boss, AI Blue, AI Purple and AI Operations.
Architects and security architects, CIOs and CISOs, platform and operations leads, heads of governance, risk, compliance and third-party risk, AI governance and AI platform teams, red, blue and purple team leads, boards and management bodies, procurement and vendor managers, supervisors and auditors, works councils and unions, data protection officers, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 20: Defending the Agent: Identity, Credential and Protocol Tools in Tools gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Agents and Autonomy” and is one of 29 drawn from the manuscript.