The Agent's Tool Call Was Safe. The Workflow Wasn't.

Why authorization has to understand the workflow, as well as the call.

A customer success agent is asked to prepare a renewal briefing. It reads every customer and contract value from the CRM. It writes them into a spreadsheet, uploads the file to a shared folder, creates a public link, and emails that link to an address outside the company.

Each of those five actions was permitted. Together, they moved your customer list out the door.

How safe steps add up

Every step matches the agent's job. It reads the CRM to prepare briefings, creates files, uses shared folders, shares links, and emails customers. No single call looks wrong, and no policy was broken.

The trigger can be as small as one line hidden in a support ticket the agent read along the way. Simon Willison calls the combination of private data, untrusted content, and outside communication the lethal trifecta, and warns: "If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to that attacker."

No attacker is required, either. An agent that misreads its task can take the same five steps.

Why existing controls miss it

Most agent controls evaluate one tool call at a time: may this agent use this tool, with these arguments, right now? Each answer is yes.

Identity and access management sees five entitlements in use. Data loss prevention sees an email with a link in it, and the file holding the data never passes through the email. The audit log shows five approved events and no incident.

The harm exists only in the sequence.

Workflow Integrity

Governing agents means deciding each action as part of the work it belongs to. That takes four requirements:

• Run context: Every action is decided with its run in view: the person the agent acts for, the task it was given, and what it has already done.
• Declared purpose: Each run states its goal and the kinds of action that goal allows. A step outside that purpose is stopped, even when the tool itself is permitted.
• Data-aware boundaries: Sensitive data stays inside the boundary its classification sets, whichever combination of permitted steps tries to move it.
• Whole-run review: The completed run is compared with how the agent normally behaves, and an unusual pattern stops the agent before its next action.

Governing the decision

At Watchlight AI, Beacon decides every action before it runs, both inside the agent's framework through our plugins and on the network path through our proxy. Each decision sees the run it belongs to: the person behind it, the declared goal and the kinds of action it allows, how many actions the run has taken, and the application's declared boundary and data classification. Beacon records every step in one execution lineage and scores each run against the agent's normal behavior. A run that drifts can quarantine the agent, so its next action is refused. Watch drift detection and quarantine in our recorded demo.

Approving each step is necessary. It is not enough. An agent's authority has to be judged by where the whole workflow is going.

Request a demo and bring the workflow that worries you most.