I, like many, have been on a journey of increasingly using AI in my work and life. It started with asking ChatGPT some basic questions; then using it to fill out my end-of-year appraisal forms (because frankly, I couldn't be bothered with it all — and we hadn't yet been told not to do that). I've watched as a good friend, Nabil Sayeed, wrote an article about how he's built his own automated workflows that build in AI using tools like n8n, and I've noticed that AI plays an increasingly prominent role in Azure Logic Apps.

More recently, when I got frustrated trying to continuously explain to people what I think an enterprise standardised approach to cyber security risk assessments could look like, I built it. Using Claude Code initially, but then I deployed an MCP server to make best use of both Gemini and Claude Code. I was able to build a functional web application that was far better than what I'd have been able to without it and in a fraction of the time that an experienced developer would have needed. In another example, when preparing for SC-100 and SC-200 exams, I couldn't find an extensive set of practice exam questions that I didn't have to pay for. So I used Claude Code to develop my own quiz engine to help me learn. (The quiz engine is available on GitHub here for anyone who is interested.)

Welcome, everyone, to the world of vibe coding. (Forrest Brazeal's cartoon on what AI will and won't do to the pile of complexity sums up where I think this goes.)

This journey left me with a few thoughts that I wanted to explore in this post.

Using tools like ChatGPT is only the beginning — there is so much more that we can do with AI. With a background in consulting, I was blown away by Saritha Prasad Vrittamani's demonstration of how it's possible to build a system to almost automatically respond to RFPs with your organisation's tone of voice and internal expertise. Every IT product in the market claims to be enabled by AI these days.

Using AI tools enables people to use technology to solve their own problems in ways that were never before possible.

With the proliferation of AI and the growing number of protocols to connect agents and models, things are about to get complicated very quickly. Securing the emerging tangle could become a nightmare in the not too distant future.

Democratisation of technology

The democratisation of technology — making powerful tools accessible to non-specialists — has always been a driving force behind innovation. We've seen this pattern repeatedly, from the personal computer revolution to cloud computing. Now, AI is following the same trajectory, as tools like Claude and ChatGPT allow people with limited technical backgrounds to harness sophisticated capabilities.

This democratisation is perhaps the most transformative aspect of the current AI revolution. When people can directly solve their own problems without waiting for IT departments or development teams, innovation accelerates dramatically. When individuals throughout an organisation can leverage AI to address their specific challenges, we see a multiplication of value that centralised AI deployment simply cannot match. According to McKinsey's 2023 "The State of AI" report, organisations that democratise AI access across departments see 3–5x greater ROI compared to those with centralised AI approaches. Similarly, Deloitte found that companies enabling widespread AI adoption achieve 30% higher productivity gains than those limiting AI to specialised teams.

Agentic AI is about to get (more) complicated

AI has moved quickly — from traditional machine learning models designed for specific tasks to today's generative AI creating content across multiple modalities. We're now entering the era of agentic AI: autonomous systems that plan and execute complex tasks with minimal human oversight.

There are, however, two distinct emerging views of what the future of the agentic AI ecosystem will grow into.

First is "Software 3.0," championed by Andrej Karpathy, who presents AI as "brilliant interns with perfect recall but no judgment" — powerful tools requiring human oversight. This model acknowledges limitations like "jagged intelligence" (excelling at complex tasks while failing at simple ones) and focuses on augmentation through human-AI collaboration, not replacement.

The second perspective is the "AI Agentic Mesh," advocated by McKinsey and other traditional consultancies. This model describes a future where autonomous AI agents form dynamic, organising networks. These agents supposedly collaborate across organisational boundaries, learning and adapting their roles based on emerging needs.

While the second view provides more comforting promises for organisations investing heavily in AI adoption, the reality in my view is that the Software 3.0 model is more likely to win out, at least in the short term, because it actually acknowledges AI's current limitations and is something that we could build today.

Irrespective of which vision comes to fruition, AI agents will require supervision; and as AI agents excel at different tasks, we will need means of interconnecting them to achieve our overall goals. This highly interconnected nature will inevitably result in complexity. Already, we have MCP (Model Context Protocol), A2A (Agent to Agent Protocol), ANP (Agent Network Protocol) and ACP (Agent Control Protocol) being put forward by Anthropic, Google, Cisco and IBM respectively — with each protocol having its own strengths and weaknesses.

For me, this growing complexity and the highly interconnected nature of AI agents, and the need to secure it, reminds me of the journey that we have already been on with microservices.

Just as microservices decomposed complex applications into smaller, specialised components, organisations now deploy networks of specialised AI agents collaborating on complex tasks. Each agent has distinct capabilities, access permissions, and objectives while functioning within an interconnected ecosystem.

Lessons from the microservices journey

I find it useful to consider how our approach to microservices security evolved over time. Initially, many organisations focused on securing individual services, implementing varying levels of protection based on perceived criticality.

This approach quickly proved inadequate. As detailed in analyses of microservices architectures, the distributed nature of microservices created a vast attack surface, and vulnerabilities in seemingly low-risk services could provide entry points to more sensitive components. Moreover, the complexity of service interactions made it difficult to understand data flows and enforce consistent security policies.

The service mesh emerged as a solution to these challenges, providing a consistent security layer across all services. By abstracting security concerns from individual services, it ensured uniform protection while simplifying management.

We're now at a similar juncture with AI systems. The organisations I've seen getting this right are those applying these hard-won lessons to their AI security strategies, implementing orchestration layers that provide consistent protection across their AI ecosystems.

From service mesh to AI orchestration

With microservices, we eventually recognised the need for a service mesh — a dedicated infrastructure layer that manages service-to-service communication, implementing consistent security, observability, and traffic management. Today, I believe we're facing a similar inflection point with AI systems, where an orchestration layer has become not just valuable but essential.

Drawing inspiration from service mesh architecture, an AI orchestration layer serves as a dedicated infrastructure layer that manages communication, security, observability, and governance across AI agent networks. The key functionalities that should be included are:

Secure agent communication. The AI agent orchestration layer should implement standardised communication protocols that enable secure information exchange between agents. Every message must be authenticated, authorised, and encrypted, creating an audit trail of agent interactions. This addresses a critical vulnerability — agents communicating through ad-hoc channels with inconsistent security controls, creating numerous opportunities for data leakage or unauthorised access.

Centralised policy enforcement. Rather than embedding security rules within each agent (where they would inevitably become inconsistent and difficult to maintain), the orchestration layer should provide centralised policy enforcement. This allows security teams to define and enforce rules about data access, permissible actions, and required approvals across the entire AI ecosystem. When regulatory requirements change, policies can be updated in one place rather than across dozens of individual agents.

Data access control and quality. When AI agents interact with corporate data through RAG (Retrieval-Augmented Generation) systems, the orchestration layer must control which data sources each agent can access. This ensures agents only retrieve information they're authorised to use, while maintaining data lineage and quality controls. This capability is crucial as AI increasingly operates on sensitive internal documents, databases, and knowledge repositories, preventing unauthorised access while ensuring agents work with accurate, up-to-date information.

Comprehensive observability. Perhaps most importantly, the orchestration layer must provide visibility into agent behaviour, interactions, and decision-making that would otherwise remain opaque. Security teams can then monitor agent actions, trace the flow of sensitive data, and detect anomalous behaviour patterns that might indicate compromise or misalignment. This observability proves invaluable during incident response, allowing teams to quickly understand the scope and impact of security events.

Balancing security with innovation

When I speak with fellow security professionals about AI, the conversation often focuses on model security, prompt injection, or data poisoning. These are legitimate concerns, but they address only part of the problem. They focus on individual AI components rather than the complex networks they form.

This limited perspective creates dangerous blind spots. In reality, some of the most significant risks emerge from the interactions between AI agents:

Traditional security approaches simply weren't designed for these scenarios. They lack the context awareness, the communication controls, and the governance mechanisms needed to secure autonomous, collaborative AI systems.

The challenge, however, is implementing these security measures without stifling the very innovation and democratisation that make AI so valuable. The most successful approaches I've observed share these characteristics:

A window of opportunity for secure AI architecture

I began this article by drawing parallels between microservices and AI agent networks. There's one more parallel worth considering — the consequences of acting too late.

Organisations operating distributed systems have already paid a heavy price for security oversights. According to IBM's 2023 "Cost of a Data Breach" report, breaches involving distributed cloud environments cost $4.75 million on average — 27.7% more than traditional environments. The 2022 Verizon Data Breach Investigations Report found that 82% of breaches involved the human element, including social engineering and errors — a risk amplified in complex distributed systems. With AI systems, these risks are compounded by their autonomous operation, expanded access to sensitive data, and automated decision-making capabilities.

We have a narrow window of opportunity to lay the foundations for secure AI agent implementations before we're left with a complicated mess that becomes increasingly difficult to unpick.

While I'm not certain whether an AI orchestration layer with service mesh characteristics currently exists in a mature form, this is precisely my call to action — we need to create one.

I invite others to share how they're securing AI agents without stifling innovation. By collaborating now, we can establish best practices before widespread adoption makes architectural changes prohibitively disruptive and expensive.

Postscript. As I finish writing this article, I noticed that IBM have announced an integration between watsonx.governance and Guardium AI Security that promises to "help clients keep AI systems, including agents, secured and responsible at scale". Also, Auth0 have an 'Auth for GenAI' product. Is the service mesh for AI agents already being built?