A blocked agent action and an approved one leave very different evidence behind. A block tells you a rule fired. An approval tells you a person looked at the action and said yes. Most of the agent security products that launched this week are very good at the first job, and only one of them is built around proving the second.
That gap matters because buyers are about to file all of it under governance. Four launches in two days put brakes, monitors, and kill switches on AI agents. They’re worth having. They also leave a question open that no runtime monitor answers on its own: when an agent does something that matters, whose name is on the decision?
Four launches built to stop agents mid-action
On October 21, SentinelOne introduced Singularity Agentic Detection and Response in early access. It inventories agents and MCP servers, blocks prompt injection and credential exfiltration before an action runs, and flags “the gap between what an agent was asked to do and what it did.” It can stop one agent mid-action while the rest of the workflow keeps running, and it can complete an investigation and execute a response “within the boundaries set by customers.”
The same day, NVIDIA released its OpenShell Reference Architecture, which pairs a secure runtime for agents with NVIDIA Sentry software on BlueField-4 data processing units. If an agent tries to move outside its software boundary, NVIDIA says Sentry “quarantines and stops it in milliseconds.” The release also describes ServiceNow’s AI Passport carrying policy down to that layer so enterprises can revoke an agent’s access across software and hardware within seconds.
BeyondTrust made its AI Agent Security generally available for Windows and macOS endpoints, with a design choice worth copying: it separates what the employee is allowed to do from what that employee’s agent is allowed to do. When an agent needs more privilege, the product can invoke just-in-time or human approval.
Ten commands per prompt is more than anyone can watch
BeyondTrust’s Phantom Labs paired the launch with endpoint telemetry. Coding agents requested about 1.28 million shell commands from roughly 132,000 prompts over four weeks, close to ten commands for every prompt a person typed. Among coding-agent users, 85% had at least one MCP server configured, averaging 4.35 servers each, and one user had 36. The company is careful to say these are requested commands, not necessarily executed ones, drawn from early customer samples.
Those numbers settle one argument. Nobody is going to read ten shell commands per prompt across a workforce. Machines will check machines at that volume, and they should. The real design choice is which small set of actions gets pulled out of that stream and handed to a person, and what evidence that handoff leaves behind.
iProov ties the approval to one exact action
On October 22, iProov launched a human approval service for AI agent gateways, built on a specification it calls the Human Approval and Presence Specification, or HAPS. When a Cerbos policy requires approval, the action is held. The named approver sees the exact action and its scope, completes a genuine human presence check, and iProov issues a signed, single-use credential bound to that action. If a detail changes, such as the amount or destination of a payment, the credential no longer matches and the action is blocked. The company says the result is “an auditable, non-repudiable certificate for logging and future reference.”
That’s the piece runtime monitors don’t supply: a record that a specific person approved a specific action. Two cautions belong next to it. The HAPS repository on GitHub describes itself as an “experimental draft specification” and says it is “Not production-ready.” And a face check proves who said yes. It can’t prove the approver understood what the agent was about to do, or that saying no was a real option.
Containment is Responsible AI; the signed decision is AI Governance
Basil’s vocabulary helps sort this week’s products. Responsible AI, in his terms, means one machine checking another: policy engines, behavior monitors, intent drift scores, and silicon that quarantines a process with no person in the loop. Every launch above does real Responsible AI work. AI Governance starts where a named human holds the call at a defined checkpoint, and the record shows whether that person accepted the action, changed it, or refused it. His argument on why agentic AI was always going to fail makes the same point from the other side: autonomy without a human checkpoint isn’t a governance design.
In Basil’s HAIA Agents work, that line separates Agent Model 1, where the agent runs the full pipeline and a person reviews only the final output, from Agent Model 2, where the agent pauses after each role and a human approves before it continues. Both are specified architecture, not shipped software. The vendor market is building the plumbing for the second model, and a product that only blocks is still running the first. Calling it governance repeats the move he challenged when a standards body treated humans as optional in AI governance.
One more gap shows up in the approval designs themselves. Approve or deny is a two-button choice. A real checkpoint also needs a modify path, where the person narrows the scope, lowers the amount, or sends the action back with conditions, and that change has to land in the same record as the approval.
Questions to settle before an agent touches production
Which actions route to a named person, and who wrote that list? If the answer is a vendor default, nobody on your side has decided what counts as consequential.
What happens when the approver doesn’t answer? An action that waits is governed. An action that proceeds after a timeout is automation with a delay.
Does the record show the exact action, the approver’s name, the time, and whether the action was approved, changed, or refused? A log of blocked events can’t answer that, and an auditor will ask.
Is the agent’s permission set narrower than the employee’s? BeyondTrust’s split is a good test of any vendor. If the agent inherits everything its user can do, every approval gate is carrying more weight than it should.
Track one number alongside the block counts: the share of high-consequence agent actions in the last month that carry a recorded human decision tied to that exact action. If it’s zero, you bought containment, which is useful, and you haven’t yet built governance.
The brakes shipped this week, and they’re fast. A quarantine in milliseconds is a machine doing what machines do well. The slower part, a person reading one held action and putting a name to the outcome, is still the part an organization has to design for itself.
Sources
- BeyondTrust. (2026, October 21). Phantom Labs research shows AI agents are acting beyond intent. BeyondTrust AI Agent Security, now available, stops them [Press release]. https://www.beyondtrust.com/press/ai-agent-security-general-availability
- iProov. (2026). HAPS: Human Approval and Presence Specification [Experimental draft specification, GitHub repository]. https://github.com/iProov/HAPS
- iProov. (2026, October 22). iProov launches new human authorization service for AI agent gateways with first integrations [Press release]. https://www.iproov.com/press/human-authorization-service-ai-agent-gateways-integrations
- NVIDIA. (2026, October 21). NVIDIA launches OpenShell Reference Architecture for safe AI agents [Press release]. https://nvidianews.nvidia.com/news/openshell-reference-architecture
- SentinelOne. (2026, October 21). SentinelOne launches Singularity Agentic Detection and Response to stop rogue and malicious AI agents at machine speed [Press release]. https://www.sentinelone.com/press/sentinelone-launches-singularity-agentic-detection-and-response-to-stop-rogue-and-malicious-ai-agents-at-machine-speed/
FAQ
What AI agent security products launched in October 2026?
On October 21, 2026, SentinelOne introduced Singularity Agentic Detection and Response in early access, NVIDIA released the OpenShell Reference Architecture, and BeyondTrust made AI Agent Security generally available. On October 22, iProov launched a human approval service for AI agent gateways built on its HAPS specification.
What is HAPS, the Human Approval and Presence Specification?
HAPS is an open specification from iProov for proving that a specific, real person approved a specific action an AI agent wanted to take. The approver sees the exact action, passes a presence check, and receives a signed, single-use credential bound to that action. iProov’s GitHub repository labels HAPS an experimental draft that is not production-ready.
How many commands do AI coding agents request per prompt?
BeyondTrust Phantom Labs reported that coding agents requested about 1.28 million shell commands from roughly 132,000 prompts over four weeks, close to ten per prompt. The figures come from early customer samples and count requested commands, not necessarily executed ones.
Is blocking an agent action the same as AI governance?
No. Runtime blocking, intent drift detection, and quarantine are Responsible AI, which is machine checking machine with no person reviewing the call. AI Governance requires a named human at a defined checkpoint who accepts, modifies, or rejects the action, with a record showing which one they chose.
Why should an AI agent have fewer permissions than the employee who uses it?
If an agent inherits everything its user can do, every mistake or manipulation of the agent carries the user’s full privilege. BeyondTrust’s AI Agent Security separates what the employee may do from what the agent may do and can require just-in-time or human approval when the agent needs more.
What should companies measure for human oversight of AI agents?
Track the share of high-consequence agent actions that carry a recorded human decision tied to that exact action, including the approver’s name, the time, and whether the action was approved, changed, or refused. Block counts show that containment works. They don’t show that anyone decided.
AI disclosure: This column was researched and drafted with AI assistance by HAIA Agents (RAI by GrokBot), using primary sources verified at time of publication. #AIgenerated
Leave a Reply