Agentic Runtime Identity Security Enforcement (ARISE) governs AI agent actions in real time during execution. The framework uses a three-layer architecture starting with deterministic governance for permissions, moving to behavioral analysis to track intent, and ending with dynamic runtime governance to control actions before completion.
Effective governance requires reaching Level 4 control depth, enabling inline pre-completion interventions for sensitive data. Comprehensive security combines centralized gateway enforcement with direct-access behavioral context. Security vendors are converging on this three-layer model to move from passive observation to active, real-time enforcement.
The Three-Layer Architecture for Governing AI Agent Actions in Motion
Based on SACR Research (2026)
Report by Paul Webber, Lawrence Pingree
Executive Summary
ARISE defines a new security category for governing AI agent actions while they execute. Traditional identity tools focus on static permissions – ARISE operates at runtime. The framework answers: should this agent take this action, with this tool/credential, right now?
Three control layers: deterministic governance → behavioral analysis → dynamic enforcement
ACD 4 (Inline Pre-Completion Interventions) is the production baseline for sensitive data
Vendors are converging around MCP governance, runtime visibility, and real-time control.
What is ARISE?
ARISE = Agentic Runtime Identity Security Enforcement
A new security discipline for governing AI agent actions while executing. Combines: identity context + delegated authority + tool governance + behavioral analysis. Operates at the point where agent intent becomes enterprise action.
Key focus areas:
- Tool calls and MCP/A2A interactions
- API invocation and credential use
- SaaS/cloud actions and data transformation
- Workflow execution and agent-to-agent handoff
- Browser/coding agent behavior
The ARISE Three-Layer Architecture
Layer 1: Deterministic Governance
Question: What is this agent allowed to access?
Establishes baseline boundaries and necessary but not sufficient controls. Includes:
- Agent identity, ownership, scoped credentials
- Allowed tools, approved APIs, MCP authorization
- RBAC/ABAC policies with JIT access and least privilege
- Human approval for high-risk actions
Limitation: Tells what should be allowed under normal conditions, but does not answer whether a live action remains appropriate.
Layer 2: Behavioral & Intent Analysis
Question: What is the agent doing, and does it make sense?
Where ARISE diverges from static identity security. Includes:
- Prompt-to-action reconstruction
- Tool-call telemetry and credential monitoring
- Intent drift detection and sequence analysis
- Behavior baselining and anomaly scoring
- Task-alignment and session-level evidence
Key insight: Not just whether agent has access, but whether behavior matches task.
Layer 3: Dynamic Runtime Governance
Question: Should this action continue, be narrowed, or stopped?
Where visibility turns into control. Includes:
- Allow/block/redact/pause actions before completion
- Step-up authentication and human-in-the-loop review
- Scope reduction, credential revocation, quarantine
- Termination, SOC escalation, ticket creation
This is the clearest point of vendor differentiation. Many vendors can observe – few can demonstrate outcome-changing control.
ARISE Control Depth (ACD) Maturity Model
Six levels measuring operational effectiveness of agentic security controls:
| Level | Capability | Example |
|---|---|---|
| 0 | No controls | Blind agent execution |
| 1 | Static inventory | Agent discovery and mapping |
| 2 | Post-event logging | SIEM alerts after action |
| 3 | Perimeter guardrails | Gateway rules and RBAC |
| 4 | Inline interventions | Block/redact before impact (production baseline) |
| 5 | Autonomous healing | Self-adjusting policy without intervention |
ACD 4 is the production baseline for agents touching sensitive data.
ARISE Core Use Cases
- Runtime Enforcement: Can the product block, allow, redact, pause, approve, revoke actions?
- Agent Identity and Delegation: Tie activity to human owner, NHI, credential, delegated authority
- Tool/MCP Governance: Inspect MCP servers, tool calls, action-level policy enforcement
- Behavioral/Intent Analysis: Detect intent drift, anomalous sequences, deviations from expected behavior
- Evidence/Audit/Response: Reconstruct prompt to decision to tool call to data to action to outcome chains
- Agentic Brains/Organizational Context: Build context graph across owners, agents, roles, workflows, policies
- AI-Powered Policy Engines: Author, recommend, simulate, tune, explain policy and action risk
- Model and Ecosystem Support: Govern multiple foundation models, MCP ecosystems, customer deployments
Runtime Visibility (Continuous Observability)
Provides granular telemetry across:
- Prompt-to-action chains
- Tool calls and data access requests
- Credential utilization
- Agent-to-agent interactions
Captures complete execution context for audit-grade evidence and session lineage.
Critical threshold: Security transitions from passive observation to active enforcement.
Real-Time Analysis (Behavioral & Intent Analysis)
Dynamically evaluates live telemetry against:
- Organizational context
- Behavioral baselines
- Policy boundaries
Detects subtle intent drift, anomalous tool sequences, privilege misuse. Produces: continuously updated risk score reflecting current behavior and intent.
Raw material: That non-deterministic governance consumes for decisions.
Real-Time Control (Dynamic Enforcement)
Sits directly in the execution path to execute pre-completion interventions:
- Allow/block/redact/pause/escalate before action completes
- Ensures delegated authority remains safe in production
Distinguishes between:
- Observing an agent
- Recommending a response
- Initiating external workflow
- Enforcing a decision directly in the action path
MCP Gateway vs Direct-Access Monitoring
MCP Gateway Approach
Agents do not directly connect to MCP servers. All communication flows through a centralized gateway that validates requests, enforces policy, and prevents credential exposure.
Pros: Centralized control, inspect tool results for poisoning, prevent access to unapproved servers
Cons: Requires architectural changes, single point of failure, adds latency to every tool call
Direct-Access Monitoring Approach
Agents connect directly to MCP servers. MCP server credentials are managed centrally (vaults, rotated regularly, scoped to tasks). Post-execution monitoring detects anomalies and credential misuse.
Pros: Preserves agent autonomy, minimizes latency, no single point of failure
Cons: Fundamentally reactive – may only identify issues after unauthorized action has occurred
Comprehensive MCP Runtime Security Requires Both
- Gateway Layer (Enforcement): Validates requests, enforces policy, prevents credential exposure. Provides centralized control and ability to inspect tool results. Limitation: Sees requests/responses but lacks deeper context for intent evaluation.
- Direct-Access Layer (Context): Integrates natively with underlying systems. Gains rich visibility into agent behavior and why actions are taken. Limitation: Observing behavior is not the same as enforcing policy.
ARISE Vendor Landscape (2026)
More than thirty providers assessed by SACR. Vendors approach the problem from different architectural starting points:
- Identity governance and privileged access management
- AI gateways and model brokers
- MCP and tool governance platforms
- Runtime AI security frameworks
Key finding: The market is converging around the three ARISE layers despite different origins.
- Layer 1 (deterministic governance) most consistently represented
- Layer 2 (behavioral analysis) less uniform – vendors differ in depth of reconstruction and context incorporation
- Layer 3 (dynamic enforcement) clearest point of differentiation
Buyer Guidance for ARISE Evaluation
Distinguish between:
- Observing an agent (discovery, activity display)
- Recommending a response (risk scores, alerts)
- Initiating external workflow (creating tickets, escalations)
- Enforcing a decision directly in the action path (block/redact/pause)
Should test whether vendors evaluate only predefined permissions or can respond to behavioral changes during execution.
For regulated, mixed-network enterprises: Layer 1 plus selective Layer 3 may be preferable initially. Layer 2 is emerging – expect it to become table stakes within 18-24 months.
The Runtime Identity Security Pyramid Model
- Foundation: Agent identity, ownership, scoped credentials, allowed tools, approved APIs
- Middle layer: Prompt-to-action reconstruction, tool-call telemetry, intent drift detection
- Apex: Real-time allow/block/redact/pause/escalate before action completes
Bottom layers are necessary but not sufficient – the apex is where visibility becomes control. Each layer builds on the previous one – skipping layers creates gaps in runtime security.
Conclusion: Runtime Security is Where It Gets Real
- Legacy audit logs are too slow for machine-speed threats
- ARISE operates at runtime, before risky activity completes
- Three layers converge: deterministic governance → behavioral analysis → dynamic enforcement
- ACD 4 (inline pre-completion interventions) is the production baseline
- MCP and tool governance provide practical insertion points for ARISE controls
- Comprehensive security requires both gateway enforcement and direct-access context
- The market is forming – buyers should evaluate vendors against all three layers
ARISE: Agentic Runtime Identity Security Enforcement for Agents
For more information, visit softwareanalyst.io/reports/arise