Don't give LLMs full control. Use deterministic code for core logic, validation, and enforcing rules. Delegate only tasks requiring flexibility or understanding of unstructured input to the LLM, treating it as a specialized component, not the entire system.

A new academic framework, ArbiterK, challenges the standard model of an LLM acting as the central controller. It inverts the paradigm by embedding the LLM within a deterministic execution system, demoting it to a suggestion engine. This ensures the system, not the probabilistic LLM, retains final control and enforces rules.

Purely agentic systems can be unpredictable. A hybrid approach, like OpenAI's Deep Research forcing a clarifying question, inserts a deterministic workflow step (a "speed bump") before unleashing the agent. This mitigates risk, reduces errors, and ensures alignment before costly computation.

Traditional systems can be controlled with simple, deterministic rules. Because modern AI agents are inherently unpredictable, effective governance requires using another layer of AI. A specialized AI must monitor, interpret, and block the actions of other agents in real-time.

A core pillar of modern cybersecurity, anomaly detection, fails when applied to AI agents. These systems lack a stable behavioral baseline, making it nearly impossible to distinguish between a harmless emergent behavior and a genuine threat. This requires entirely new detection paradigms.

Relying solely on natural language prompts like 'always do this' is unreliable for enterprise AI. LLMs struggle with deterministic logic. Salesforce developed 'AgentForce Script,' a dedicated language to enforce rules and ensure consistent, repeatable performance for critical business workflows, blending it with LLM reasoning.

Instead of simply blocking unexpected agent behavior, Eve Security's platform actively questions the agent to understand its intent. This 'interrogation' process cross-references the agent's answers with other systems to determine if a new behavior is legitimate or malicious, enabling more nuanced control.

Instead of costly, constant monitoring by a large AI, an effective security model uses small, specialized 'intuition' models. These models' sole job is to flag suspicious actions for review by a more powerful AI, optimizing for cost, latency, and performance.

Training Large Language Models to ignore malicious 'prompt injections' is an unreliable security strategy. Because AI is inherently stochastic, a command ignored 1,000 times might be executed on the 1,001st attempt due to a random 'dice roll.' This is a sufficient success rate for persistent hackers.