{"resourceId":"checkableai-prisma-airs-controls-38-findings-8-supported-20261104","versions":[{"version":"external-542585a9d9ac74d0db95ac2e8fe8b88f0a584fe23642b5900e216cbc4378aa1c","resource":{"id":"checkableai-prisma-airs-controls-38-findings-8-supported-20261104","title":"Checkable AI control review of Prisma AIRS: 8 of 38 agent-security controls documented as supported, with no human-approval step, agent kill switch or delegated identity","organization":"Checkable AI (agent-researched knowledge base with human review)","sector":"AI agent security controls","geography":"Global product; review published for Australia, EU and US audiences","publishedAt":"Checkable AI knowledge base, scope documented Oct. 9, 2026; last checked Nov. 5, 2026 (site date)","publicationDate":null,"eventDate":null,"sourceName":"Checkable AI","sourceLabel":"Palo Alto Networks Prisma AIRS: AI security controls and findings","sourceUrl":"https://checkableai.com/stack-check/platforms/prisma-airs/","evidenceClass":"independent-research","outcomeClass":"cautionary","topics":["developers-agents","governance-procurement","data-security"],"finding":"Checkable AI maps Prisma AIRS (AI Runtime, AI Supply Chain Security, AI Red Teaming, AI Gateway, AI Agent Discovery and Cortex AISPM integration) against 38 agent-security controls using only public vendor documentation, and finds 8 supported and 30 not addressed. Supported items include the AI Gateway model gateway with per-team budgets and guardrails, governed agent-to-agent calls (Americas region only), and a hybrid data plane that keeps payloads in the customer environment. Gaps include no human-approval workflow (verdicts are allow or block), no local file or shell permission model for agents, no sandbox or agent kill switch, no delegation of the initiating user's identity, no per-agent retrieval filtering and no behavioral baseline. The review states it is not a test of a live deployment. The page was last checked Nov. 5, 2026 (the site's own date, likely Australian time), after an earlier Oct. 19 check.","sledRelevance":"SLED agencies and universities piloting AI agents (caseworker assistants, IT help-desk agents, coding agents) are often told one platform covers agent security. Interpretation: this independent mapping shows Prisma AIRS is a content-inspection and gateway layer; approvals for consequential actions, agent permission scopes and kill switches must come from other controls. Transferability caveat: the review is documentation-based and written for a multi-country audience, not tested in a US public-sector environment.","evidence":"Opened and read the full knowledge-base page, including the control-area table and per-control findings with quoted vendor statements. Documentation review, not hands-on testing.","architectureImplications":"Prisma AIRS should be designed in as one layer: content scanning and model/MCP gateway, combined with separate identity, permission, sandbox and approval controls.","governanceImplications":"Interpretation: AI use policies requiring human approval of high-impact agent actions cannot rely on AIRS verdicts alone.","securityPrivacyImplications":"Lack of credential rotation for per-agent OAuth clients and no delegated identity increase blast radius if an agent is compromised.","caveats":"Documentation-based review, not a live test; agent-researched with human review; findings may change as the vendor documents new features; Americas-only availability noted for some gateway features.","streamIds":["palo-alto-networks"],"roles":{"sales":"Sales framing: this review helps set honest expectations for Prisma AIRS in agent projects. It shows strong gateway and content-scanning coverage but finds 30 of 38 agent-security controls not addressed in public documentation, including human approval and kill switches. A bounded engagement could be an agent-control gap assessment that maps a customer's planned agents to these controls. Do not claim AIRS alone satisfies an agency AI policy that requires human approval of agent actions.","engineering":"Engineering framing: treat Prisma AIRS as the inspection and gateway tier of an agent architecture. Identity delegation, local and remote permission scopes, sandboxing and approval workflows must come from the agent platform, identity provider or endpoint controls. Engineers should verify region availability for AI Gateway features, test hybrid data-plane deployment where payload residency matters, and document which of the 38 controls each other component covers.","delivery":"Delivery framing: an agent program built on Prisma AIRS needs a control matrix showing who covers each gap the review identifies. Delivery would assign owners for approvals, permission scopes and emergency shutdown, then test each before go-live. Proposed acceptance criteria include a tested kill-switch procedure and documented approval steps for high-impact actions. Risks include assuming gateway verdicts equal governance and losing track of agent credentials that cannot be rotated."},"roleDetails":{"sales":{"customerProblem":"Agencies piloting AI agents need assurance that approvals, permissions and shutdown controls exist, not just content scanning.","stakeholders":["CISO","Chief data or AI officer","Agent program owner","Identity and access management team","Internal audit"],"discoveryQuestions":["Which planned agents can take consequential actions without human approval?","How will agent credentials be rotated or revoked?","Which product supplies an agent kill switch?","Do AI Gateway features need to run outside the Americas region?"],"valueHypothesis":"Interpretation: a documented control map can shorten security review of agent pilots by showing where AIRS fits and where other controls apply.","potentialEngagement":"An agent-security control gap assessment against the 38 controls, scoped to one or two planned agents.","unsupportedClaims":["Complete agent governance from one product","Live-tested effectiveness","Compliance with a specific state AI policy"]},"engineering":{"fit":"Strong for gateway, budgets, guardrails and inventory; limited for agent permissions, approvals and containment.","architectureIntegration":"AI Gateway and runtime scanning in front of models and MCP tools, combined with IdP, endpoint and agent-platform controls.","prerequisites":["Prisma AIRS licence and Strata Cloud Manager access","Agent inventory","Identity provider integration"],"constraints":["Several gateway features Americas-only","No documented approval workflow","No local permission model"],"security":"Per-agent OAuth secrets lack documented rotation; no delegated identity to downstream systems.","proofOfValue":["Verify each claimed supported control in the customer tenant","Test approval and kill-switch procedures supplied by other components","Confirm payload residency with the hybrid data plane"]},"delivery":{"work":"Build a control matrix, assign gap owners, implement compensating controls and test before go-live.","dependencies":["Agent platform capabilities","Identity provider","Endpoint security controls"],"ownership":"The AI governance lead owns the control matrix; security operations owns AIRS configuration.","skillsAdoption":"Staff need to understand which risks AIRS covers and which require separate processes.","governanceCheckpoints":["Control matrix approved before pilot","Kill-switch test before production","Quarterly re-check against vendor documentation"],"acceptanceCriteria":["Proposed: every high-impact agent action has a documented approval step","Proposed: kill-switch procedure tested within an agreed time","Proposed: all agent credentials have a rotation or revocation path"],"risks":["Over-reliance on allow/block verdicts","Unrotatable agent credentials","Region-limited features unavailable to the tenant"]}},"retrievedAt":"2026-11-05T04:08:52Z","enrichedAt":"2026-11-05T04:11:19Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Teams must integrate and operate several control products, increasing skill demands on small security staffs.","procurementImplications":"Buyers should request a control-by-control coverage statement and map gaps to other products before award.","operatingModelImplications":"Ownership of agent approvals, permissions and shutdown must be assigned outside the AIRS console.","sourceVerification":{"openedUrl":"https://checkableai.com/stack-check/platforms/prisma-airs/","referenceExcerpt":"Not covered. No human approval workflow. Verdicts are allow or block.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}