Tuesday, November 17, 2026

1:30 PM - 2:30 PM

Bradman Theatre

---

Sponsored by

---

Presentation Outline

AI agents create a security problem that conventional application security was not designed for. They make judgement calls rather than follow fixed rules, and they can consume documents, email, websites, databases and tool responses, reason over that information, and then act using delegated credentials and access to other systems. The distinction between data and instructions is no longer clean. Information an agent encounters can change what it does next. Recent incidents, including OpenAI's 2026 Hugging Face incident, where an evaluation agent escaped containment and compromised third-party infrastructure, show why the model itself cannot be treated as a trusted security boundary. There is a second problem that arrives sooner. An agent operating with a person's credentials can reach everything those credentials allow, including untidy shares and folders inherited from departed staff. Need-to-know then breaks down at machine speed. If an agent returns information to someone who was not authorised to see it, conventional audit trails may not tell you what the agent previously accessed, under whose authority, or why. Senetas CTO Julian Fay will examine what makes agentic AI different, why the same characteristics that make agents powerful also create their vulnerabilities, and what this means for defence environments built around identity, classification, need-to-know and releasability. The session argues for a different trust model: assume the AI can be mistaken, manipulated or behave unexpectedly, and enforce authority outside the model. Rob Linton, who leads development of Sovrata at Senetas, will showcase our approach. Sovrata delivers zero-trust AI access from the storage layer up—enforcing policy on every read, query and vector search before data ever reaches the model. Two users ask the same AI the same question against the same underlying data and receive different answers according to their identity, authority and policy context. Where one user requests a restricted record by name, the system responds as though the record does not exist. A single policy engine governs every access path, whether the requester is a person or an agent, and each decision is recorded as tamper-evident evidence. The objective is not to make AI trustworthy. It is to build an environment in which powerful AI agents can operate without having to be trusted. If you cannot open a document, neither can your AI assistant.

---

Speaker