ConSentra and the Next Phase of AI Agent Security
Navar is developing a solution called ConSentra to tackle some pressing security concerns around generative AI. Traditionally, when we discuss the security of these models, we focus on questions like: Can someone trick the system? Can a malicious command skew the AI’s outputs? Will it accidentally share sensitive information? While these questions remain important, the landscape of enterprise AI is changing, and with it, the nature of security challenges.
Today, AI systems are increasingly connected to various external platforms and services, like APIs, databases, and identity systems. They aren’t just generating responses anymore; they are performing actions that can affect the real world. This shift raises serious security issues. For instance, a wrong answer is one thing, but if an AI has the capability to modify important data, send emails, or even execute financial transactions, the stakes are much higher.
Navar’s ConSentra is aimed at addressing this complexity. Recent findings from OWASP, a respected organization focused on improving software security, highlight this evolution. Their newly released OWASP Top 10 for Large Language Model (LLM) Applications for 2026 shows a clear shift in risk priorities. While risks like prompt injection and sensitive information disclosure remain at the forefront, a new risk called Excessive Agency has emerged as the third biggest concern. This highlights the potential dangers when AI models are connected to real-world tools and functions.
Excessive Agency and Complete Mediation
OWASP defines Excessive Agency as having three main issues: excessive functionality, excessive permissions, and excessive autonomy. Their recommendations emphasize well-known control measures like reducing permissions, limiting available functions, and requiring approvals for significant actions. One crucial takeaway is the idea of “complete mediation,” meaning that security calls should be made by a separate system rather than the AI itself.
This concept is very much in line with what ConSentra is designed to do. If you think about a basic AI agent in an enterprise setting, it might receive a request to analyze an issue and decide it needs to access a specific tool. It could be anything, like fetching a customer record or updating an account. In many early designs, if the agent had access that indicated it had permission to do so, it was assumed to be clear for action. However, that’s not sufficient for secure enterprise operations.
For true security, an AI agent seeking to take action shouldn’t also be the judge of whether that action is appropriate. Instead, the system must independently assess the request, considering various factors like who is making the request, who gave the agent authority, which tool is involved, what action is being taken, and whether company policies allow for that specific action.
The Evolving Role of Identity Security
This leads us to the evolving role of identity security concerning agent security. Traditionally, identity and access management (IAM) followed a straightforward model: a user authenticates their identity, and then they’re allowed access based on that identity. This framework gets more complicated with agentic AI, as there can be at least two separate identities involved — the AI agent itself and the individual or system it is acting on behalf of. Therefore, it’s crucial to keep these identities distinct. An AI agent shouldn’t simply inherit all permissions its user has, nor should its own credentials bypass user restrictions.
The authorization process must account for a full context, including the agent, the person delegating authority, the action being requested, and the current policies in place. ConSentra is designed to delve into this area, providing a layer of independent oversight between an AI agent and the systems it interacts with.
What Happens When the Model Is Compromised?
A key question to consider is what happens if there’s a successful attack, such as prompt injection, which could manipulate the AI’s actions. Security efforts largely focus on stopping these injections, but as OWASP’s updates stress, the clear boundaries between commands and data in today’s LLMs are not always well-defined. This means that businesses should not assume they can eliminate these risks entirely.
If a malicious command does manipulate an AI agent, architecture becomes critical. The AI could be misled into invoking an administrative tool based on false information. However, the enterprise’s security measures shouldn’t be solely reliant on the model’s judgment of what it can or cannot do. If a model is compromised, the resulting commands should not automatically grant it permissions or change resources without appropriate oversight.
ConSentra stands out because rather than merely improving prompt filters, it is built on the understanding that AI models can be inaccurate, confused, or compromised. The key concern is how much authority such failures should wield. So, in developing ConSentra, Navar is not just looking to enhance security but fundamentally rethinking how we manage permissions and maintain the integrity of actions taken by AI agents in real-world scenarios.
Understanding Authorization in Action
The ConSentra project is designed around a model that focuses on what happens at the moment an action is executed. Before any action is processed in a larger corporate system, ConSentra aims to verify identity, clearly define the requested action, check the established policy, and then make an authorization that is tied to that specific action.
This authorization can link to several important factors, including:
- the agent involved,
- the principal who delegated the task,
- the upstream system in question,
- the tool being used,
- the specific action taken,
- the resource accessed,
- any standardized arguments,
- expiration details, and
- the policy that granted the authorization.
If any of these conditions change, the original authorization should no longer apply. This creates a different level of trust compared to simply giving an agent a powerful access token and expecting them to use it responsibly.
This also sets up a system for revocation, protects against unauthorized replays, ensures human review for major actions, and provides an audit trail for why something was allowed. While ConSentra is still a work in progress, it is being developed thoughtfully and deliberately, with plans to roll it out in stages. We’re not presenting the entire functional design as a finished product right now, but we are clear about our security approach.
What ConSentra Is — and Is Not — Designed to Address
It’s worth noting that ConSentra isn’t designed to address every risk associated with AI. This clarity is crucial. Our alignment of ConSentra’s architecture with the latest OWASP Top 10 shows that it has a strong focus on managing Excessive Agency and effectively addressing issues like Prompt Injection, Misinformation, Hidden Context Exposure, Sensitive Information Disclosure, and Improper Output Handling.
However, some risks are not within its scope. For example, model poisoning relates to problems in training and data pipelines, while embedding attacks are more about security in data retrieval. Additionally, concerns about leaking training data can’t be resolved simply through an authorization process.
Effective security solutions need to have clear limitations as much as they need robust controls. ConSentra’s boundary is specifically focused where an AI agent tries to translate an intention into an action within the enterprise.
Moving Beyond Traditional Authorization
As AI agents become more widely adopted, the security framework surrounding them must evolve accordingly. Traditional authentication helps us identify which agent is connecting, and typical authorization indicates what a user or system can generally do. But for agentic systems, we need to ask a more detailed question:
Can this agent perform this precise action for this specific resource with these specific parameters right now?
This moves us beyond typical chatbot security and represents a significant advancement in identity and access management.
What Comes Next
We will continue to share updates as ConSentra transitions from planning to operational software, including our insights on security for multi-cloud environments, agent identity verification, enforcement of policies, execution-based authorization, revocation processes, and practical challenges in applying reliable controls to systems that work probabilistically. The effectiveness of AI security will not only hinge on preventing models from making errors, but also on understanding the extent of authority those errors are allowed to carry.
