Article: Jake Williams, a security researcher, unveiled the CUSTODY framework this week, giving enterprises a way to set explicit runtime permissions and boundaries for AI agents that operate inside corporate networks. The tool matters because, unlike traditional software, AI agents can dynamically fetch data, invoke services and modify models—all without a clear, enforceable policy—leaving a gap that attackers have already begun to exploit.

Why AI agents need a fence

Enterprise AI stacks now include chat-bots, recommendation engines, autonomous decision-makers and dozens of background agents that pull data from internal APIs or third-party services. Existing security suites focus on perimeter firewalls, endpoint protection and network segmentation, but they lack a standard method to say “this agent may read customer records but may not write to the finance database.” The absence of such runtime controls has already led to incidents where compromised agents were used to exfiltrate data or corrupt model weights.

How CUSTODY fills the gap

CUSTODY introduces a rule-based language that describes what an AI agent is allowed to do once it connects to a network. Policies can specify:

  • Resource access – which databases, file stores or APIs the agent may query.
  • Action limits – whether the agent can only read, or also write, delete or trigger downstream jobs.
  • Execution context – constraints on the compute environment, such as CPU quotas or container isolation.

At runtime, the framework intercepts the agent’s calls and checks them against the policy set, blocking any operation that falls outside the defined boundaries. This stops a hijacked agent from wandering unchecked through the corporate environment.

Plugging CUSTODY into existing stacks

The framework sits alongside current security tools. It can hook into popular orchestration platforms, container runtimes and API gateways, but the exact steps vary by the underlying agent platform. Organizations must map their AI inventory, write policy files for each class of agent, and test the enforcement layer before full deployment. Scaling these policies across dozens of agents will require a dedicated operational effort to keep rules up-to-date as models evolve.

Caveats and push-back

Critics note that CUSTODY does not generate policies automatically; security teams have to craft them manually, which can be labor-intensive. There is also a risk of performance overhead if every call is inspected in real time, especially for high-throughput inference services. Finally, the framework’s effectiveness depends on broad adoption—if a vendor’s AI platform cannot expose the necessary hooks, CUSTODY’s controls may be bypassed.

What to watch next

  • Vendor response – whether major AI platform providers will embed CUSTODY-compatible hooks or offer their own runtime-policy engines.
  • Standardisation – any movement toward industry-wide specifications for AI agent permissions could turn CUSTODY into a de-facto baseline.
  • Community feedback – early adopters will reveal real-world policy complexity and performance impact, shaping future versions.

Enterprises that rely on AI agents should evaluate CUSTODY now, map where it fits in their security stack, and start piloting policies before the next wave of AI-driven attacks hits their networks.