Cisco Authorize Every Action

Prabhu Barathi and Neil Patel of Cisco showed how Cisco Secure Access is extending zero trust from controlling access to authorizing every action that users and agents take. They covered AI Access for generative AI, intent-based AI guardrails, an agent gateway that governs LLM, MCP, and SaaS API traffic, and intent-based inspection that stops indirect prompt injection. The session continued the secure the workforce portion of Cisco Security’s appearance at Security Field Day 16.

Barathi said AI Access identifies more than 3,800 generative AI applications to expose shadow AI. Tenant controls redirect users from unapproved tools like Grok to ChatGPT Enterprise and disable switching to personal workspaces. Because prompts are unstructured, regex pattern matching falls short, so AI guardrails inspect user intent for prompt injection, unsafe content, and privacy leaks. Patel, who leads product management for the Secure Access agent gateway, said the gateway can act as the inference endpoint for agents. That lets administrators limit which models each user and agent can reach and weight requests across providers like Bedrock, Vertex, and Anthropic to control cost. It can also hand agents dummy GitHub or AWS tokens and swap in the real credentials inline, so secrets are never exposed to the agent. In a beta demo, Codex reached a CRM through the gateway, but policy blocked a product manager’s attempt to bulk-close cases.

Patel said the gateway enforces controls when agents point to it explicitly. Without that, it relies on TLS inspection, backed by agent hooks in AI Defense for Endpoints. He said the capabilities will move into an agent security experience in Cisco Cloud Control and be licensed together under AI Defense. Barathi then argued that URL filtering cannot catch malicious instructions hidden inside legitimate MCP tool calls. In his demo, a malicious Notion page told an agent to suppress its security warnings, and the agent then handed over password and credit card pages. With intent-based inspection enabled, the same requests were blocked under a data exfiltration policy. Barathi closed by stressing that this is not a new product to buy. Instead, Cisco is adapting controls built for the human workforce to agents.