From the Palo Alto Networks edition of November 4, 2026
Checkable AI control review of Prisma AIRS: 8 of 38 agent-security controls documented as supported, with no human-approval step, agent kill switch or delegated identity
Checkable AI (agent-researched knowledge base with human review) · AI agent security controls · Global product; review published for Australia, EU and US audiences
- Publisher
- Checkable AI
- Original publication
- Checkable AI knowledge base, scope documented Oct. 9, 2026; last checked Nov. 5, 2026 (site date)
- Source retrieved
- 2026-11-05
What happened
Checkable AI maps Prisma AIRS (AI Runtime, AI Supply Chain Security, AI Red Teaming, AI Gateway, AI Agent Discovery and Cortex AISPM integration) against 38 agent-security controls using only public vendor documentation, and finds 8 supported and 30 not addressed. Supported items include the AI Gateway model gateway with per-team budgets and guardrails, governed agent-to-agent calls (Americas region only), and a hybrid data plane that keeps payloads in the customer environment. Gaps include no human-approval workflow (verdicts are allow or block), no local file or shell permission model for agents, no sandbox or agent kill switch, no delegation of the initiating user's identity, no per-agent retrieval filtering and no behavioral baseline. The review states it is not a test of a live deployment. The page was last checked Nov. 5, 2026 (the site's own date, likely Australian time), after an earlier Oct. 19 check.
Why it matters
SLED agencies and universities piloting AI agents (caseworker assistants, IT help-desk agents, coding agents) are often told one platform covers agent security. Interpretation: this independent mapping shows Prisma AIRS is a content-inspection and gateway layer; approvals for consequential actions, agent permission scopes and kill switches must come from other controls. Transferability caveat: the review is documentation-based and written for a multi-country audience, not tested in a US public-sector environment.
Evidence and measured results
Opened and read the full knowledge-base page, including the control-area table and per-control findings with quoted vendor statements. Documentation review, not hands-on testing.
Limitations and uncertainty
Documentation-based review, not a live test; agent-researched with human review; findings may change as the vendor documents new features; Americas-only availability noted for some gateway features.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-05; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies piloting AI agents need assurance that approvals, permissions and shutdown controls exist, not just content scanning.
- Stakeholders
- CISO
- Chief data or AI officer
- Agent program owner
- Identity and access management team
- Internal audit
- Discovery questions
- Which planned agents can take consequential actions without human approval?
- How will agent credentials be rotated or revoked?
- Which product supplies an agent kill switch?
- Do AI Gateway features need to run outside the Americas region?
- Value hypothesis
- Interpretation: a documented control map can shorten security review of agent pilots by showing where AIRS fits and where other controls apply.
- Potential engagement
- An agent-security control gap assessment against the 38 controls, scoped to one or two planned agents.
- Unsupported claims
- Complete agent governance from one product
- Live-tested effectiveness
- Compliance with a specific state AI policy
Pre-sales engineering
Role takeaway
- Fit
- Strong for gateway, budgets, guardrails and inventory; limited for agent permissions, approvals and containment.
- Architecture and integration
- AI Gateway and runtime scanning in front of models and MCP tools, combined with IdP, endpoint and agent-platform controls.
- Prerequisites
- Prisma AIRS licence and Strata Cloud Manager access
- Agent inventory
- Identity provider integration
- Constraints
- Several gateway features Americas-only
- No documented approval workflow
- No local permission model
- Security
- Per-agent OAuth secrets lack documented rotation; no delegated identity to downstream systems.
- Proof of value
- Verify each claimed supported control in the customer tenant
- Test approval and kill-switch procedures supplied by other components
- Confirm payload residency with the hybrid data plane
Delivery
Role takeaway
- Work
- Build a control matrix, assign gap owners, implement compensating controls and test before go-live.
- Dependencies
- Agent platform capabilities
- Identity provider
- Endpoint security controls
- Ownership
- The AI governance lead owns the control matrix; security operations owns AIRS configuration.
- Skills and adoption
- Staff need to understand which risks AIRS covers and which require separate processes.
- Governance checkpoints
- Control matrix approved before pilot
- Kill-switch test before production
- Quarterly re-check against vendor documentation
- Acceptance criteria
- Proposed: every high-impact agent action has a documented approval step
- Proposed: kill-switch procedure tested within an agreed time
- Proposed: all agent credentials have a rotation or revocation path
- Risks
- Over-reliance on allow/block verdicts
- Unrotatable agent credentials
- Region-limited features unavailable to the tenant
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Prisma AIRS should be designed in as one layer: content scanning and model/MCP gateway, combined with separate identity, permission, sandbox and approval controls.
Governance
Who approves, reviews and stays accountable for outcomes?
AI use policies requiring human approval of high-impact agent actions cannot rely on AIRS verdicts alone.
Security and privacy
What data, permissions and controls need testing?
Lack of credential rotation for per-agent OAuth clients and no delegated identity increase blast radius if an agent is compromised.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Teams must integrate and operate several control products, increasing skill demands on small security staffs.
Procurement
What should contracts, pricing and exit terms secure?
Buyers should request a control-by-control coverage statement and map gaps to other products before award.
Operating model
Which teams own the service once it runs?
Ownership of agent approvals, permissions and shutdown must be assigned outside the AIRS console.
Publication history
- 2026-11-04Palo Alto Networks · Issue 063 resources
Stable resource ID: checkableai-prisma-airs-controls-38-findings-8-supported-20261104