Can you prove what your AI agent touched?
The four questions every security review asks about AI agents — and the architecture that answers them with evidence, not screenshots. Includes the section most vendors skip: what we do NOT claim.
From plain English to a signed, scheduled run
How a non-programmer's request becomes an Ed25519-signed workflow revision — composed capabilities, human approval, a durable schedule that can't change anything, and evidence of every run.
How workflow drift is caught: flagged, gated, suspended
Capability changes after approval are flagged at the governance gates; source schema drift suspends the capability — every call refused before any query executes. Both tiers, verified on a live deployment.
CVE-2026-21852: How Cursor's AI Agent Mode Was Compromised
Why prompt injection in agentic systems is fundamentally different from traditional injection attacks — and why your API gateway, WAF, and IAM can't see the problem.