Agent security became a market in the last eighteen months. Most of it inspects text or governs enterprise identities. Almost none of it controls the single action at the moment it happens — and none of it is built for the person running their own agent.
Three things are now broadly agreed. Prompt injection is not going away — the builders of the models say so. The damage happens at the action, not in the text: OWASP's list is mostly about tools, identity, and privilege, not bad outputs [1]. And authority has to be narrower and shorter-lived — identity vendors now say agent access should be “task-scoped” and “short-lived,” and that “every tool call becomes an authorization decision” [9].
Nobody has turned that last sentence into something an ordinary agent can carry.
| APPROACH | WHAT IT DOES | WHO IT'S FOR | WHERE IT FALLS SHORT |
|---|---|---|---|
| Guardrail classifiers | A model reads prompts and outputs and blocks what looks malicious. Lakera, Protect AI and Prompt Security now sit inside Check Point, Palo Alto and SentinelOne. | Enterprise | Probabilistic. Bypassed by paraphrase, encoding, and new techniques. The agent still holds every key. |
| Red-teaming & testing | Attack the agent before launch to find what breaks. Promptfoo went to OpenAI; Virtue AI to Fortinet. | Builders | Finds problems before launch. Doesn't enforce anything while the agent is running. |
| Agent identity & NHI governance | Give every agent an identity, inventory its credentials, rotate them. Okta, IBM, and a wave of startups. | Enterprise IT | Answers who the agent is. Mostly silent on which single action, for which request, shaped by which input. |
| Runtime control planes | Inline platforms that infer an agent's intent and block risky actions. Zenity, and others raising large rounds. | Enterprise SOC | Closed SaaS. Often a model judging a model — the thing being attacked is also doing the checking. |
| Protocols | MCP authorization binds tokens to one server [10]; AP2 carries signed payment mandates [11]. | Everyone | The right plumbing, coarse grain. A scope like files:write can't say which file or why. |
| Capability research | CaMeL tracks where each value came from and checks policy at the tool call — provable security on AgentDojo [12]. | Researchers | Lives inside one custom interpreter. Not a format anything else can carry. |
| Obol | An open, signed, single-use token per action, minted from your request, checked by a gate with no model in it, receipted. | People and small teams running real agents | Early. Research preview, not a product — see Horizon. |
Almost every runtime product puts a model in the enforcement path. Obol puts a signature check there. You can't sweet-talk a hash.
Identity tells you who. Scopes tell you roughly what. A coin tells you this call, these arguments, this request, this one time.
The market sells to security teams. The always-on personal agent — the one Singapore's cyber agency issued an advisory about [4] — has no one selling it a seatbelt.
Obol has been rebuilt twice. The first version watched traffic and correlated it with kernel audit logs to catch an attack in progress. The second, run in April 2026 on an isolated lab server, gated an agent's tools behind an approved plan and enforced it at the kernel. The coin design comes directly out of what the second version taught us. The first version is written up as a paper: Obol: Runtime Defense Against Prompt Injection in Autonomous LLM Agents (March 2026).
Small samples, one lab, one day of runs. Directional, not conclusive. Full protocol and raw outputs will be published with the reference gate.