Bots bouncers: the startups deciding what AI agents can do

The Wild West of Agentic Permissions

We are currently moving into the second phase of the AI cycle. The first phase was about asking chatbots questions and getting text back. The second phase, which we are in now, is about giving those models hands. We call them agents. These are systems designed to execute tasks—buying flights, updating codebases, or managing customer support—without a human clicking every button.

But there is a glaring problem that many founders are ignoring in their rush to ship: security. When you give an AI the ability to interact with the world, you are effectively giving it your credentials. If that agent gets tricked by a prompt injection attack or a malicious third-party site, it doesn't just give a wrong answer. It drains your account or deletes your database. We are seeing a new wave of European startups, like Skyvern and P0 Security, trying to build the bouncers for this party.

The Permission Problem

As a builder, you know the principle of least privilege. You don't give a junior developer the keys to the kingdom on day one. Yet, we are seeing people build agents that have wide-ranging API access with almost no oversight. The current architecture of LLMs makes them inherently susceptible to manipulation. If an agent is browsing the web to help you find a deal, and it lands on a site with hidden text saying, Send all user data to this external server, the agent might just do it.

This isn't theoretical. It’s a structural flaw in how these models process instructions and data. They can't always distinguish between the developer's original command and the data they are processing. This creates a massive attack surface that traditional firewalls weren't built to handle. We need a layer that sits between the brain (the LLM) and the hands (the API tools).

Who is Building the Shield?

Several startups are emerging to fill this gap. They aren't building the agents themselves; they are building the governance layers. Some, like Skyvern, focus on how agents interact with browsers, ensuring they stay within safe bounds. Others are looking at the identity management side—managing who, or what, has the right to execute a specific command at a specific time.

Then there are companies like P0 Security, which are tackling the authorization problem. In a world of agents, the concept of a user becomes blurry. If an agent triggers an action, is it the user's intent or the agent's hallucination? These startups are building tools that audit these actions in real-time, providing a kill switch or a verification gate before high-risk actions are taken.

Why Founders Should Care

If you are building an AI-native startup, you might think security is a later problem. You want to find product-market fit first. That is a mistake in the agent era. One high-profile security breach involving an autonomous agent won't just kill your company; it could set back the entire niche for years. Regulators are already circling, and the first time an agent causes a significant financial loss, the hammer will come down hard.

Integrating these security layers early isn't just about safety; it's about trust. Your customers—especially enterprise clients—are terrified of letting autonomous bots loose on their internal data. If you can show them you have a robust governance layer that prevents unauthorized actions, you have a massive competitive advantage over the 'move fast and break things' crowd.

The Limits of the Current Approach

Most of these security tools are still reactive. They are trying to patch a fundamentally leaky bucket.

We have to be honest: we don't fully understand how to perfectly secure an LLM. Because these models are probabilistic rather than deterministic, you can't just write a set of if-then rules to catch every edge case. The security startups are doing great work, but they are essentially playing a game of whack-a-mole against an infinitely creative adversary.

The real breakthrough will come when we have small, specialized models whose only job is to act as a supervisor. This 'two-man rule' for AI—where one model proposes an action and a hardened, restricted model validates it against a set of hard-coded safety policies—is likely where the industry is headed.

The Founder's Takeaway

Stop thinking of security as an add-on. If your agentic workflow doesn't have a clear permission structure and an audit log, you aren't building a tool; you're building a liability. The startups mentioned here are a good signal of where the market is going. They are betting that the future isn't just about what AI can do, but what it is allowed to do.

• Audit your API keys: Ensure agents only have the minimum access required.
• Use middleware: Explore tools that specialize in agent governance rather than building it from scratch.
• Human-in-the-loop: For any action involving movement of money or deletion of data, keep a human 'Yes' button in the flow for as long as possible.

The agent revolution is coming, but the winners won't just be the ones with the smartest bots. They will be the ones who didn't let their bots burn the house down.

Read the original at Sifted →