The intern will not police the intern
Amir Ofek’s intern analogy is doing a lot of work in the ARISE conversation, and it deserves to. In the SACR fireside he describes agents the way anyone who has onboarded juniors will recognise: eager, goal-driven, unclear on unwritten rules, not malicious. Pingree adds the vehicle version: a point-and-shoot car pointed at a corner. You do not fix that with a note on the dashboard that says “please brake.” You put a barrier on the corner.
The ARISE Playbook’s operational version of the same idea:
An alert is not a control. By the time a notification fires, the agent has already made the call, moved the data, or sent the message. Agents act at machine speed. There is no window between the action and its consequence for a human to step into.
This post in our ARISE series is the design principle underneath the failure modes. Identity, intent, MCP – none of them survive if the only copy of the policy lives in a system prompt.
Prompt instructions lose to the objective
MIT Technology Review documented models that understand they are reward-hacking and do it anyway. Remediation prompts increased the behaviour. Ofek’s gloss: the agent knows. It optimises anyway. Because the goal is the score.
That is not a model-quality problem you will prompt your way out of. It is a structural fact about a system that treats your policy as one more string in a context window competing with the user’s request, retrieved documents, tool results, and (if you are unlucky) injected instructions. We have watched this play out in small form – the pilates booking – and in large form – Hugging Face. In both cases someone could have written “don’t do that” in the prompt. In both cases the shortest path to the goal ignored it.
OWASP’s agentic Top 10 treats tool misuse as a first-class risk for the same reason. Least agency is not a nicer system prompt. It is the minimum autonomy required for a bounded task, enforced somewhere the model cannot talk itself past.
Application-layer guards – if tool == "delete": require_approval() in the agent framework – are better than prose. They are still procedural code in the same process as the thing you are trying to constrain, specific to that framework, invisible to a security review of the identity stack, and absent on the next intern’s laptop that called the API directly. SACR’s three agent archetypes matter here: homegrown, SaaS-platform, and local workforce tools. A LangGraph hook does not follow the employee into Copilot Studio or Claude Desktop.
Perimeter versus runtime
Pingree’s concert analogy: checking bags at the gate is not the same as having people inside the venue. Identity at provisioning is the gate. ARISE is inside.
The Playbook’s definition of agent identity insists it be continuously maintained, because the gap between provisioning and now is the risk. That is why quarterly access reviews fail agents. A person’s access looks roughly the same in March as in January. An agent’s effective scope can change between two reviews – new connector, new model, rewritten prompt – without a single IdP permission changing. The review is accurate the day you run it.
Human-in-the-loop, the most cited answer in enterprise AI, fails in production for related reasons. Chen Pipek (aizome CPO) has argued the instinct is correct and the implementation is not: you cannot sit a human on every consequential tool call at machine speed without consent fatigue, rubber-stamping, or the agent routing around the pause. SACR’s vendor notes on Keycard and Apono are the mature version – escalate when the privilege is high-risk, not on every GET. Even that assumes there is a control point that can pause the call. A prompt that says “ask a human” cannot.
Infrastructure means the path you actually control
You cannot install your policy engine in Salesforce. You cannot rely on every MCP server to honour a spec it never implemented. You cannot assume the agent runtime is one you wrote. The hop you own is outbound: the moment your identity calls their API.
That is RequestRocket’s job in an ARISE stack, restated without the product tour: the agent gets a URL and a caller credential. It does not receive the vendor secret. It does not receive a vote on whether the rule applies. If the call is off intent, the proxy refuses before the upstream sees it. If the volume leaves the envelope, the meter refuses. If the response is oversized with PII, the filter strips it. The model can “decide” whatever it wants. The wire does not care.
Compose, do not replace:
- IdP – who may invoke the agent; JWT on the caller hop.
- Secrets manager – where the vendor key lives at rest.
- Agent runtime / guardian – reasoning traces, prompt-level product policy, HITL UX.
- EDR/MDM – local clients that never came to the proxy.
- SIEM – the join of identity events and per-call decisions.
- Outbound proxy – the deterministic refuse.
SDK guardrails (Alter, Aport, framework hooks) are a legitimate enforcement point. They require discipline in every codebase and they do not cover the SaaS-built agent. Transparent proxy is the other point: no agent code changes, any HTTP API. The landscape post is the category map. ARISE is the reason the egress column has to exist.
Kill switch, without the theatre
CISOs in the fireside asked for a kill switch. Ofek’s useful nuance: not every process needs the cold stop; injectable, midstream correction is the behavioural future. Both still require being in the path. Revoking an Okta session stops new authentications. It does not always stop the process that already holds a vendor API key in memory. Revoking the caller credential on the proxy, or disabling the proxy, stops the next outbound call even if the local process is still “running.” That is the unglamorous kill switch. Use it with meters so the first instinct is a ceiling, not an incident bridge.
Next steps
Take one policy you currently keep in a prompt – “never export all customers,” “refunds under $100,” “do not call production.” Express it as a deny-by-default allow-list and a meter. If you cannot, it was never a control.
Continue with least privilege for the data that comes back. Docs or start for free.