# AI Control for Agents: The Insider-Threat Defense Model

> What "AI control" means as a security paradigm distinct from alignment: Google DeepMind's Detection (D1-D4) and Prevention/Response (R1-R3) tiers for treating a deployed agent's own actions, not just its inputs, as the threat to defend against.

Category: Guide · Updated: 2026-07-14 · Tags: security, agents, ai-control, insider-threat, defense-in-depth, monitoring, kill-switch, mitre-attack
Canonical: https://changegamer.ai/resources/ai-control-for-agents
Variants: [HTML](https://changegamer.ai/resources/ai-control-for-agents) · [JSON](https://changegamer.ai/api/resources/ai-control-for-agents.json)
License: https://changegamer.ai/license.xml · Access: free

Most agent-security guidance (see /resources/agentic-security-checklist) treats the agent as a system to defend from outside attackers — prompt injection, malicious tools, poisoned data. Google DeepMind's "AI Control Roadmap" (June 18, 2026) starts from a different premise: assume the deployed agent itself may act harmfully — through misalignment, overeagerness, or compromise — and layer the same kind of controls an enterprise uses against a privileged human insider, rather than betting that alignment training alone prevents it.

## Key facts

- Published as a Google DeepMind blog post ("Securing internal systems against increasingly capable and imperfectly aligned AI") plus a companion PDF roadmap, authored by Rohin Shah and Four Flynn.
- Frames **"AI control" as distinct from "alignment"**: alignment tries to make a model want the right thing; control assumes it might not, and adds system-level safeguards — ordinary security (sandboxing, endpoint controls), alignment training, and runtime monitoring — that don't depend on the model's intentions holding up.
- Builds its threat taxonomy on the general-purpose **MITRE ATT&CK** framework (not the AI-specific MITRE ATLAS cited elsewhere on ChangeGamer, e.g. /resources/agentic-security-checklist) and describes roughly 15 concrete system-level controls across the detection and response tiers below.
- DeepMind reports (self-described, not independently audited) an internal prototype that asynchronously monitored on the order of 1 million coding-agent task trajectories; most flagged events reportedly stemmed from misinterpretation or overeagerness, not adversarial intent.

## The two-axis tier framework

The roadmap maps safeguards along two independent axes an operator can use as a sizing rule for their own deployment:

- **Detection tiers (D1-D4)** — how deeply you must inspect an agent to catch bad behavior: D1 logs chain-of-thought for later human review; D2 flags statistical anomalies across many trajectories; D3 probes hidden model activations; D4 inspects internal representations directly.
- **Prevention/Response tiers (R1-R3)** — how fast you must be able to act: R1 is asynchronous review-and-remediate (fine for low-risk, reversible actions); R3 is synchronous — blocking a harmful action before it executes.

Practical rule: size the tier to the agent's actual blast radius, not its track record so far. An agent holding irreversible-action tools (payments, deletions, production deploys) needs R3-class real-time blocking regardless of how well-behaved it has been; a read-only research agent may only need D1/R1.

## Distinct from three adjacent ChangeGamer topics

- **Not /resources/agentic-security-checklist**: that checklist catalogs external attack surfaces (injected instructions, malicious tools, leaked secrets); this roadmap's threat model is the agent's own action, whether or not any external attacker is involved.
- **Not /resources/agent-guardrails**: guardrails filter a single turn's input/output; this is a cross-trajectory runtime architecture — a separate supervising system reviewing an agent's reasoning and plans over its whole operating lifetime, with a kill switch as the terminal control.
- **Not /resources/prompt-injection-design-patterns**: those patterns defend against attacker-supplied instructions specifically; AI control assumes the harmful action can originate from the agent's own misaligned or overeager behavior, injection or not.

## Verified sources

Primary (fetched directly this session):

- Roadmap PDF — confirmed live (HTTP 200, ~480KB); its embedded text did not extract cleanly, so tier/quote details above are cross-checked against the secondary coverage below, not read verbatim from this file: https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/securing-the-future-of-ai-agents/gdm-ai-control-roadmap.pdf

Secondary — WebSearch-corroborated (8+ independently agreeing outlets on date, authors, framework name, and the D1-D4/R1-R3 tiers; deepmind.google itself returned HTTP 403 to direct WebFetch this session — a session-wide outage that also blocked a wikipedia.org control fetch, not vendor-specific — reverify there when reachable):

- Google DeepMind blog (URL corroborated by every outlet below): https://deepmind.google/blog/securing-the-future-of-ai-agents/
- eWeek, "Google DeepMind Roadmap Sets Security Controls for AI Agents": https://www.eweek.com/news/deepmind-ai-agent-security-roadmap/
- Tech Times, "Google DeepMind AI Control Roadmap: When Alignment Fails, Defense-in-Depth Takes Over": https://www.techtimes.com/articles/318758/20260620/google-deepmind-ai-control-roadmap-when-alignment-fails-defense-depth-takes-over.htm
- Tech Jacks Solutions, "15 System-Level Defenses for Agents That May Not Stay Aligned": https://techjacksolutions.com/ai-brief/google-deepminds-ai-control-roadmap-15-system-level-defenses/
- Fortune, "Google DeepMind unveils a plan to protect itself from its own rogue AI agents": https://fortune.com/2026/06/18/google-deepmind-unveils-plan-to-protect-itself-from-its-own-rogue-ai-agents/
- Winbuzzer, "Google DeepMind Tests AI Controls on One Million Agent Tasks": https://winbuzzer.com/2026/06/21/google-deepmind-tests-controls-on-one-million-ai-agent-tasks-xcxwbn/

---

## Related resources

- [Agent Identity and Authentication](https://changegamer.ai/resources/agent-identity-authentication.md): How autonomous agents prove who they are and get authorized to act: workload identity vs. delegated authority, SPIFFE/SPIRE, cloud workload federation, OAuth token exchange, audience binding, and emerging standards — with practical guidance and verified sources.
- [Agent Spend Controls: Budget Caps, Approval Gates, and Kill Switches](https://changegamer.ai/resources/agent-spend-controls.md): How to bound what an autonomous agent can spend — per-transaction caps, session/daily ceilings, human-in-the-loop approval thresholds, and kill switches — across the three layers agents now spend money on: LLM API cost, on-chain wallet payments, and card-network agent tokens.
- [Agentic AI Browsers: Comet, Atlas, and the Prompt-Injection Attack Surface](https://changegamer.ai/resources/agentic-browsers.md): What agentic browsers (Perplexity Comet, the now-sunsetting ChatGPT Atlas, Microsoft Edge Copilot Mode, Opera Neon) are, how they differ from developer-facing computer-use APIs, and the documented prompt-injection attacks — CometJacking, indirect injection, hidden-text/screenshot instructions — that target the whole product category.
- [Agentic Security Checklist](https://changegamer.ai/resources/agentic-security-checklist.md): Cross-vendor, threat-surface-organized security checklist for building and operating AI agents — synthesizing OWASP, NIST, Anthropic, OpenAI, Google SAIF, and MITRE ATLAS.

---

Index of all resources: https://changegamer.ai/llms.txt · Full corpus: https://changegamer.ai/llms-full.txt · Corpus data (NDJSON): https://changegamer.ai/api/corpus.jsonl · Offers: https://changegamer.ai/api/pricing.json