DeepMind AI control roadmap for securing AI agents

An AI agent with access to repositories, cloud systems and email resembles a privileged employee at the technical level: it has identity, tools, an objective and the ability to execute a sequence of actions. Google DeepMind therefore proposes controls familiar from insider-risk and privileged-access programmes—least privilege, separation of duties, monitoring and rapid shutdown.

This is not a claim that Gemini attempted to escape or acted strategically against users. DeepMind explicitly says current models do not show strategic, egregious goal misalignment. The roadmap also covers hypothetical risks from future, more autonomous systems.

From one prompt to a complete trajectory

Agent safety often focuses on one response: whether the model reveals a secret, follows a dangerous instruction or succumbs to prompt injection. Operational risk emerges across a sequence. Reading a file, changing configuration and sending a request may look acceptable individually while together forming exfiltration.

In Securing the future of AI agents, DeepMind describes analysis of one million coding-agent task trajectories and a live monitor for Gemini Spark. The objective is to detect patterns across a complete instance and multiple sessions, not only filter a single prompt.

Most flagged cases reportedly resulted from overzealousness or misunderstanding, not hostile intent. Control systems must stop dangerous errors without describing every mistake as an attack.

TRAIT&R as a threat map

TRAIT&R is inspired by MITRE ATT&CK. It organises potential unwanted agent behaviours such as gaining additional permissions, avoiding monitoring, expanding access, manipulating artefacts and maintaining operation.

The AI Control Roadmap v0.1 does not claim that every technique has appeared in production. Like ATT&CK, it supports threat modelling and detection-coverage analysis.

The roadmap describes detection levels D1–D4, prevention/response levels R1–R3 and 15 safeguards covering action monitoring, access control, role separation, result verification and emergency-stop infrastructure.

Three security layers

DeepMind’s Three layers of agent security separates:

1. model safety: training, evaluation and manipulation resistance;
2. agent-system security: tools, memory, permissions and boundaries;
3. AI control: detecting and containing an unwanted trajectory when earlier layers fail.

This is defence in depth. Do not assume the model will always recognise a malicious instruction. Design the environment so an incorrect decision has limited impact and leaves reliable evidence.

Applying the roadmap in a company

Give the agent its own identity. Shared employee credentials destroy accountability. Each instance needs an identifier, scope and lifetime.

Limit capability, not only intent. API allowlists, short-lived tokens, restricted egress and separate read/write identities are stronger than a prompt saying “do nothing dangerous”.

Separate duties. An agent preparing a change should not approve deployment. Payments, publication, deletion and permission changes require an independent gate.

Log the full trajectory. Record prompt, plan, tool calls, identity, outcome, errors and monitor decisions in logs the agent cannot edit.

Block irreversible actions synchronously. An alert after data has been sent is too late. Selected actions wait for policy evaluation or human approval.

Correlate sessions. Slow access expansion may span many tasks. Monitoring should connect identity, target and behaviour over time.

Test shutdown. A kill switch, token revocation and environment isolation must work when the agent loops or creates excessive traffic.

These controls extend our AI agent deployment guide and AI red-teaming methodology.

Measuring AI control

Track coverage of techniques and assets, recall against simulated dangerous trajectories, precision of alerts, time to block before impact and disruption of legitimate work. A monitor that alerts on every command will quickly be ignored.

The central conclusion is not that “AI has become an insider”. It is that any system with identity, tools and authority deserves controls comparable to other privileged principals. Current models may produce an overzealous error more often than strategic misconduct, but the operational effect can still be real.

---

Sources: Google DeepMind, AI Control Roadmap v0.1, Three layers of agent security.