Securing AI Systems: Implementing Effective Containment Architecture

Why agentic AI changes cybersecurity architecture

Generative AI and agentic systems are changing the assumptions that have shaped cybersecurity architecture for decades. Unlike conventional applications, AI agents can interpret goals, select tools, generate code, retain context, and adapt their actions as conditions change. As these systems gain greater autonomy, organizations must prepare for more than inaccurate output or prompt injection.

They must address the possibility that an agent could misuse legitimate access, cross an assumed boundary, or combine individually permitted actions into an unintended and potentially harmful outcome.

SecureBlu’s AI Containment Architecture overview

SecureBlu’s AI Containment Architecture provides a defense-in-depth model for managing this risk. It treats AI as an untrusted workload and assumes that prompts, models, software dependencies, credentials, and preventive safeguards can fail. Instead of relying on a single sandbox or policy layer, AICA applies reinforcing controls across the full operating environment. At a high level, the whitepaper examines:

• Governance and policy: approved models and use cases, agent risk tiers, data classifications, delegated authority, action budgets, rate limits, and machine-enforceable guardrails.
• Facility and infrastructure: dedicated or access-controlled compute, physical separation where warranted, independent management paths, and emergency shutdown procedures.
• Network containment: default-deny egress, microsegmentation, inspected gateways, DNS controls, restricted service paths, and rapid network isolation.
• Identity and access: separate identities for agents and tools, least privilege, short-lived credentials, workload attestation, just-in-time access, and automated revocation of tokens, sessions, certificates, and secrets.
• Runtime and tool security: microVM or equivalent isolation, signed and read-only artifacts, ephemeral execution, resource ceilings, controlled memory and storage, sandboxed tools, and explicit function contracts.
• Data protection: data masking, tokenization, DLP, approved retrieval paths, encryption-key control, restricted memory writes, and isolation of sensitive data stores and indexes.
• Behavior monitoring: immutable telemetry for prompts, memory, tool calls, identities, actions, and network activity, supported by detection for goal drift, persistence, lateral movement, abnormal discovery, exploit generation, and unauthorized agent collaboration.
• Human authorization: approval gates for privileged tools, sensitive data, external actions, high-impact decisions, exceptions, recovery, and reactivation.
• Kill switches and automated containment: coordinated logical, identity, network, compute, data, and physical stop mechanisms, backed by deterministic playbooks, evidence preservation, escalation thresholds, and controlled human override.

Layered, independently enforced control planes

A central principle of the model is that these controls must be layered, independently enforced, and operational. Governance, policy, execution, observation, and response functions are separated so that no single service can authorize an action, execute it, and conceal the result. The whitepaper also explains how control effectiveness changes across on-premises, public-cloud, hybrid, edge, disconnected, and locally hosted model deployments. Local inference receives particular attention because placing a model on an internal host does not make it trusted; the model, weights, loaders, retrieval components, memory, tools, management interfaces, and network paths still require isolation.

A staged path to containment and controlled autonomy

Organizations do not need to implement the highest-assurance architecture on day one. They can begin by inventorying models, agents, tools, identities, data sources, and deployment locations; classifying each use case by autonomy and business impact; and defining an acceptable blast radius. From there, teams can establish minimum controls across facility, network, identity, runtime, behavior, and human authorization layers; test kill switches and containment timing; validate evidence preservation and recovery; and prioritize improvements through a staged maturity model.

Engineering AI environments where failure is survivable

The goal is not to assume that AI will always behave as intended—it is to engineer an environment in which unexpected behavior is visible, authority can be withdrawn quickly, and failure remains survivable.

Where to learn more

To gain deeper insights, we invite you to explore New Era's comprehensive whitepaper on AI Containment Architecture.