Are You Actually Going to Give the Agent Write Access?

A signature matched. That was the whole trigger. Cisco NetRanger, shunning turned on, and the system did exactly what it was configured to do: it wrote an access-control list to the downstream router. Chris Kirschke watched a production system go from hero to zero in seven minutes, then spent longer than the outage itself figuring out how to power-cycle a router that size. Sean Gray was in the data center with him, still in college.

That afternoon is the only time in 27 years of security operations that Chris has enabled write access on a production system. In a career that ran from the IDS era through cloud portfolio security at Albertsons and field-CISO work at Tuskira, the pen came out one time, and production paid for it in minutes.

Keep that story in mind the next time a vendor demos autonomous remediation, because on episode 102 of the podcast, recorded after Chris and I ran into each other at Gartner Security & Risk 2026, he hands you the question he now puts to every one of them: are you actually going to give an agent write access?

“I watched a production system go from hero to zero in 7 minutes.”

Chris Kirschke, founder and CEO of Kyberis AI, on episode 102

What is autonomous remediation, and why is it a 25-year-old pitch?

Strip the branding and “autonomous response” is the same product Chris turned on all those years ago: a system that observes something, decides it’s bad, and changes production without waiting for a human. Cisco’s own launch announcement for NetRanger, dated November 1998, promised sensors that “can automatically terminate the specific connection, permanently block the attacking host, log the incident and send an alarm” (Cisco newsroom, November 1998). Cisco had bought the product from WheelGroup, a 75-person company in San Antonio, nine months earlier (Cisco newsroom, February 1998). Read that launch sentence again with “agent” in place of “sensor” and you have most of this year’s expo floor.

The mechanism was, and is, exactly what it sounds like. Cisco’s documentation for the descendants of that sensor still describes the blocking feature (the older term was shunning) as the sensor “applying ACLs or VACLs” to a router or switch it manages, and it carries the warning Chris learned the expensive way: you must tune the sensor to identify the hosts and networks that can “never be blocked,” because otherwise legitimate traffic is what gets shunned (Cisco, Shun/Block on IPS for ASA/PIX/IOS Router). The 2026 version has a large language model where the signature engine used to be, which mostly means it can be wrong in more creative ways, faster, with a persuasive explanation attached.

And the timing of this conversation is almost too neat. We published the receipts from the week AI agents showed up on both sides of the breach: OpenAI’s own agents swarming Hugging Face, a ransomware crew talking Cursor into helping. The throughline of both incidents was exactly this: agents with write access do agent things. Chris got there decades earlier with one ACL. The blast radius has grown since; the physics haven’t changed.

His question is a gate, and gates open. The useful work is on the far side of it: what would have to be true before the answer is yes.

Why “trust the inputs” decides whether an agent deserves write access

Chris borrows his answer from a thesis Jason Clinton laid out at Anthropic: if you can’t trust the inputs, you’ll never trust the output. And he’s insistent that this rule has nothing to do with AI. It holds whether the thing consuming the input is a level-one analyst, a 2003-vintage intrusion detection system, or a threat-hunting agent. NetRanger didn’t malfunction that day. It executed faithfully on an input it trusted too much, and one signature match earned the authority to rewrite a router.

“If you can’t trust the inputs, you’ll never trust the output.”

Chris Kirschke, Kyberis AI, episode 102

Now run the modern version. Your agent’s inputs aren’t one signature feed; they’re threat intel of wildly uneven quality, telemetry an attacker may be shaping, and context windows that trust whatever lands in them. OWASP’s Top 10 for LLM applications files the outcome under Excessive Agency (LLM06:2025) and names the three root causes plainly: excessive functionality, excessive permissions, excessive autonomy (OWASP GenAI Security Project). The triggers are the usual suspects, hallucination and prompt injection. The damage comes from how much authority was waiting behind them. An agent acting on unvetted inputs isn’t autonomous security. It’s the seven-minute outage with a better vocabulary, or, in the words Chris’s own company ships on its homepage: your agents shouldn’t be confidently wrong.

The positive version of the rule is the one worth building on. The quality of what your agents read is now a security control, which means the unglamorous assets you already own (your logs, your ticket history, your threat feeds, your SIEM) are the foundation your future automation stands on. Chris is blunt about the last one: “You’re not getting rid of the SIEM. It’s written into the frameworks.” Your evidence store is the input layer your agents will reason over, so its quality has quietly become a strategic asset rather than a compliance checkbox.

Read before write: the AI agent permission ladder

Here is the shape of the answer we give founders who ask how to say yes to an agent without re-running the NetRanger afternoon. Think of write access as a ladder with four rungs, and make the agent climb it on evidence.

Rung 1: read. The agent queries logs, tickets, telemetry and threat intel. It correlates, summarizes and flags. Nothing changes in production. Most of the value of a security agent lives here, and it’s the rung where you learn how often the thing is wrong.

Rung 2: propose. The agent drafts the change: the firewall rule, the pull request, the ticket, the revocation. A person reads it and executes it, or doesn’t. This rung generates the evidence for everything above it, because every proposal is a labeled sample of the agent’s judgment. It is also the rung where an agent can be the independent reviewer of another agent’s pull request while a human still owns the merge.

Rung 3: write behind approval. The agent executes, but only after a named person approves that specific action with the inputs shown first. OWASP’s mitigation list for Excessive Agency says it in one sentence, “utilise human-in-the-loop control to require a human to approve high-impact actions before they are taken,” and the Model Context Protocol, the standard your agents increasingly use to reach tools, agrees: there “SHOULD always be a human in the loop with the ability to deny tool invocations” (MCP specification, Tools).

Rung 4: autonomous write, on a leash. The agent acts alone inside a declared, reversible scope and escalates everything outside it. Blocking a single external IP for fifteen minutes is on the leash. Rewriting a core router’s ACL is not, and that is the distinction NetRanger was never given.

For a reference frame outside our own, the Cloud Security Alliance published a six-level autonomy scale in January 2026, running from Level 0 (the AI informs, humans execute every action) to Level 5, which it considers unsuitable for enterprises today (CSA, Leveling Up Autonomy in Agentic AI). Our first two rungs sit at Level 0, rung three spans Levels 1 and 2, and rung four is Level 3 with the leash made explicit.

Two details make the ladder a control rather than a slide. First, give every agent its own identity. Graham Neray, co-founder and CEO of Oso, put the reason in one line on episode 89: “We tolerate over-permissioning for humans. AI won’t.” We wrote about that human-versus-agent difference at length in why agents need least privilege more than humans ever did. Second, don’t confuse a label for a control. MCP lets a tool declare readOnlyHint and destructiveHint, and the specification itself notes that all such annotations are hints, “not guaranteed to provide a faithful description of tool behavior,” and that clients “should never make tool use decisions” based on annotations from untrusted servers (MCP schema reference). The rung is enforced by the credential and the approval step, never by the tool’s description of itself.

What evidence earns each rung of write access?

“Write access is earned, not demoed” is easy to say in a meeting. It’s more useful as a checklist of what has to exist before you move an agent up a rung, and it doubles as the list of questions to put to a vendor.

Its own identity. One service account or workload identity per agent, with nobody’s human credentials borrowed. This is table stakes at rung one, and it’s the question buyers’ security teams have started asking about coding agents: which account does it run under, and who approved its last change? Most Series A teams can’t answer the first half, because the same credential has been shared since the seed round and nobody has scoped it since. Fixing it is the first thing we do in an AI access control audit, and it unblocks everything else.

Provenance on every input. Where did each fact the agent is reasoning over come from, and how confident is the source? This is the “trust the inputs” thesis made operational, and it’s why Chris’s threat graph scores confidence and carries provenance for every claim: an agent citing it can show why it believes something, not just that it does.

A proposal history. Weeks of drafts that a person reviewed, with a false-positive rate you actually know. You can’t rehearse autonomy in a demo. You rehearse it at rung two, in your environment, on your traffic.

Declared scope. What the agent may touch and, more importantly, what it may never touch, written down before it runs. Ged Ossman, founder and CEO of Interf, made the case on episode 99 for treating this like a mobile app’s permission manifest, declared in advance and pre-authorized at runtime:

“If vendor agents need something from enterprise, it should be specified in a machine-readable form, in a way where compliance and security teams can quickly assess the risk.”

Ged Ossman, founder and CEO of Interf, on episode 99

He was blunter about the alternative: “everyone thinks AI is a magic box.” The declared scope is also where Cisco’s old never-block list lives on: the hosts, accounts and tables no agent gets to touch, whatever the input says. We covered the declare-before-deploy model in AI agent governance starts at onboarding, not runtime, and the readiness side in the pre-flight check before you deploy an agent.

Rehearsed blast radius. Before rung three, run the worst action the agent could take in staging and test the rollback. Chris’s recovery took longer than his outage because nobody had ever asked how you power-cycle a router that size. Ask it in advance, on purpose, with the clock running.

A named approver and an audit trail. Who said yes, to what, on which inputs, at what time. This is the record that turns an incident into a fifteen-minute conversation instead of a forensics project, and it’s the evidence an ISO 42001 auditor, an enterprise AI committee, or the same buyer who asked for your SOC 2 will want to see.

A kill switch and a time-boxed grant. Write access that expires on its own, and an alert that pages a human the moment the agent acts. If you’re going to let something hold the pen, you want someone watching it hold the pen.

A vendor demo shows the action working once. Procurement should ask for the other six rows.

CISO does not spell CEO (he took the job anyway)

Here’s the part of Chris’s story that explains the product. When a venture studio’s general partner asked him to run a company, his first answer was the episode title: CISO does not spell CEO. Twenty-seven years of operator skepticism said no. Then he took the job, because the thing worth building was the gate itself rather than another system asking for the pen.

Kyberis AI is that gate: a threat graph that ingests any OpenCTI-compliant feed, commercial or OSINT, structures decades of threat data into one graph, and serves it to security agents over the Model Context Protocol, confidence-scored and provenance-grounded. Notice what’s missing from that description: remediation. The read side comes first. Trustworthy inputs are the product, because they’re the prerequisite for everything vendors keep trying to sell you on the write side, and the developer portal reads the same way: resolve threat entities, retrieve evidence, rank what matters in your environment, change nothing. His ask at the end of the episode is one line: go there and start building against it.

He also has a theory about why so many of this generation’s tool builders are 20-year operators, and it turns on a phrase he credits to Justin Lamb: “You have the scar tissue to know what you don’t know.” Agents don’t have scar tissue. Your permission model has to supply it. And the trust-the-inputs rule reaches further down the stack than software: two episodes later, Roei Ganzarski of Alitheon made the case that the hardware under your zero trust is trusted because of a sticker, which is the same question asked of the input beneath every other input.

That’s the operator-skepticism-becomes-product-thesis arc, and it’s why the CEO title finally fit. What he sells is the thing autonomy has to earn.

The rest of the field notes

The episode is 41 minutes and dense, so a sampler of what else is in there. The best governance idea of the year arrives as a joke: an engineer at Gartner wired up an anti-CISO agent, connected to his own Gartner login, his actual tech stack, and his team’s real engineering bandwidth, so when an executive discovers a shiny thing, he can have Claude explain to his boss why they’re not doing it yet. An agent whose job is saying no, with receipts. Steal this. Notice, too, that it’s a rung-one agent: all read, no write, and already the most useful agent in the building.

Chris’s verdict on the “AppSec is dead” discourse is one word, horseshit (his, not ours), and the logic is hard to argue with: agents are writing more code than ever, so the surface the discipline covers is growing, and every developer’s blast radius grows with it. The line I kept coming back to on the recording was agents execute, humans steer, and the pen belongs with the steering.

And two teasers worth the listen. There’s the hoodie-or-suit question Chris would hand his younger self, the identity fork every security career hits. And when I asked what he’d write an angel check for tomorrow, the answer had nothing to do with security and everything to do with decoding what his teenage daughters just said to him. Twenty-seven years of threat intelligence, still defeated by teen slang. If you build that translator, Chris is good for the check.

The rule worth stealing: write access is earned, not demoed

For a scaling startup, Chris’s career compresses into one procurement rule: write access is earned, not demoed. In practice, agents read before they write, and they read from sources with provenance rather than whatever feed was cheapest. Destructive actions keep a human on the pen until you’ve rehearsed the blast radius, the same way you’d scope any agent’s identity to least privilege and treat authorization as infrastructure rather than an afterthought. And when a vendor says “fully autonomous,” ask Chris’s question out loud in the meeting: are you actually going to give the agent write access? The good vendors have an answer with layers in it. The rest have a demo.

If you’d like to know which rung your agents are on today, an AI access control audit maps every credential they hold and cuts it to least privilege, with the evidence buyers ask for; if your agents reach tools over MCP, the Secure MCP program puts the approval step and the audit trail where the protocol says they belong. If you’d rather hear the story first, Chris tells it in 41 minutes on episode 102, including how he eventually found the power switch.

Chris waited 27 years to hand over the pen a second time, and when he finally did, it wasn’t to an agent. It was to a company built to make agents earn it. The outage took seven minutes. The trust took a career. That ratio is the entire lesson.