FREQUENTLY ASKED QUESTIONS
What does an AI policy actually look like?
It looks like a list of actions with an autonomy level against each one. In the vendor-review agent behind Mountain Theory's published run, every action the agent can take sits in one of four levels. Autonomous: read vendor evidence, summarize a SOC 2 report, create a draft risk review. Semi-autonomous: create a remediation ticket. Human-gated: finalize a risk rating, approve a high-risk vendor, send an external email, close a remediation ticket, deploy an infrastructure change. Prohibited: delete an evidence file, or follow an instruction embedded in a vendor's own document. Every level requires an audit entry, including the prohibited ones, because a refused action is evidence too. You write that list in plain English and Mountain Theory enforces it before the action runs.
How do you decide which AI actions need a human?
By what the action changes, not by how risky the request sounds. In the published run the dividing line is authority: an agent may draft, summarize, analyze and recommend on its own, because none of those is an authoritative change. The moment an action writes to a system of record, commits the business, or reaches outside the building, it needs a person. That is why "draft a risk rating" is autonomous and "finalize a risk rating" is not, and why "recommend approve or deny" is autonomous and "update the procurement status of record" is not. The same reasoning puts external email behind approval. You set that line yourself, and everything on the safe side of it runs at full speed.
Can you stop an AI agent from deleting evidence?
Yes, and Mountain Theory published a run where exactly that was tested. In the vendor-review agent's policy, deleting or overwriting original evidence is prohibited outright rather than approval-gated, on the grounds that evidence integrity is not something anyone should be able to sign away in the moment. When the agent was told to clean up old evidence after a review, the deletion never executed, and the refused attempt was written to the audit log. Ungoverned, in the same run, the deletion completed.
What is AI agent drift?
AI agent drift is when an autonomous agent starts behaving differently because the model underneath it changed, not because anyone changed its instructions. Mountain Theory saw this in its own published run in the last week of July 2026: a third-party vendor updated the foundation model driving a demo agent, in a change aimed at making it better at chaining tools together, and the agent began attempting multi-step tool paths it had never tried, improvising raw shell commands instead of the sanctioned scripts, and reaching for the network to answer questions it had previously answered locally. Nobody wrote a malicious prompt. The instructions were ordinary. What changed was the capability.
Can an AI agent change behavior after a model update?
Yes, and Mountain Theory has published a run where exactly that happened. The behavior was novel on the day it ran: no prior incident, no advisory, no sample to write a rule against. Mountain Theory blocked all of it on the day it appeared, without writing a new rule, shipping a signature or a definition update, pushing a patch, retraining anything or subscribing to a threat feed. In that run, 12 of 12 dangerous scenarios completed with nothing in the path, every run, and 0 of 12 completed with Mountain Theory in the path, in any run.
How do you control an AI agent built on someone else's model?
By governing the action rather than trying to anticipate the actor. You do not control when a hosted model changes and you may not be told; your prompts, your policies and your infrastructure can be identical from one day to the next while the thing making the decisions is not. Mountain Theory checks each action an agent proposes against policy written in plain English and returns ALLOW, HOLD or BLOCK before the action executes. It asks whether this should be allowed to happen and who authorized it, rather than whether anyone has seen it before, so an action nobody has ever seen is still just an action asking for authority it may not have.
Is it safe to let AI do work on its own?
It is safe when something checks each action before it happens. AI does not have to be hacked to cause damage; it only has to be wrong while it holds real permissions. In Mountain Theory's published run, four of the 12 scenarios were not attacks at all but ordinary work the agent was supposed to complete, and after a vendor model update all four went off script too. With nothing in the path, every one of them ended the same way the attacks did. With Mountain Theory in the path, none of them did. You choose which actions are worth pausing for a person, and everything else runs at full autonomy.
What proof is there that Mountain Theory actually stops an autonomous AI action?
Two published runs, both with terminal recordings and both naming the third-party technology involved. In the first, the same 10 actions were run in the same order under three configurations. Ungoverned, 10 of 10 executed. Under NVIDIA OpenShell alone, all 5 sandbox-boundary crossings were denied at the kernel and all 3 in-bounds bad decisions still went through, including a secrets read that printed credentials to the screen. Under OpenShell plus Mountain Theory, those same 3 actions returned HOLD, HOLD and BLOCK, and the secrets read was stopped before it executed, so the credentials never printed. In the second, a third-party provider updated the foundation model driving an autonomous agent. Nothing on our side changed, the agent began attempting multi-step actions it had never tried before, and every attempt was stopped on 30 and 31 July 2026, the days the behavior first appeared. No new rule, no signature, no patch.
Does a FedRAMP authorization or SOC 2 mean a vendor can control autonomous AI?
No. A compliance authorization attests to how a vendor runs its own service: that controls exist, that processes are documented, that evidence is retained. That is real and it matters in procurement. It is not a measurement of whether a product can stop an autonomous agent from taking a specific action, because no compliance regime was designed to test that. A vendor can hold every certification available and still have nothing in the path when an agent decides to delete evidence, disable a control, or read secrets it is technically permitted to read. The only thing that shows an action was stopped is a run where that action was attempted and did not execute.
Does Mountain Theory need policy updates to stop new attacks?
No. Novel agent behavior has been stopped the day it appeared with no rule update, no signature, no retraining and no threat feed, in a published, recorded run. The system runs as a real-time learning loop: every action and every decision feeds it, it rules on behavior it has never seen in the moment, and it decides for itself whether what it learned becomes a new policy, a family of policies, or nothing at all. It has also been demonstrated live. In August 2026 a public university's AI Director and engineering team watched an autonomous agent's breach attempt and tool chaining stopped in the moment, with nothing changed, not even a policy. That demonstration is why the university moved forward with a proof of concept.
Does reporting rogue AI agent activity mean it is under control?
No. Reporting tells you an agent crossed a line. Control is what stops it crossing. On 11 August 2026 more than 120 organizations, including NVIDIA, Cisco and CrowdStrike, proposed the Shared AI Findings Exchange, or SAFE, through the Open Secure AI Alliance with the Linux Foundation. It is an incident reporting framework modeled on aviation safety reporting: collect AI incidents and near misses confidentially, notify the organizations affected, identify the control failures that keep recurring, and publish evidence-based recommendations. That is useful work and the industry needs it. It is also, by design, a record of what already happened. The two questions are separate. One asks what went wrong across the industry last quarter. The other asks whether this action runs right now, and no reporting framework was built to answer it. An enterprise wants both: something to learn from afterwards, and something in the path beforehand.
How should I evaluate competing AI security vendors on evidence?
Ask every vendor for the same four things and compare the answers side by side. First, the action set: exactly which actions were attempted, in what order. Second, the control condition: what happened with nothing in the path, so there is a baseline to measure against. Third, the outcome per action, including the ones the product did not stop. Fourth, the recording or log. A vendor who publishes all four is making a checkable claim. A vendor who publishes a certification, an integration list or a customer logo is telling you about their process and their distribution, which are different questions. Mountain Theory publishes all four, including the actions it does not have a policy for.
What is AI infrastructure defense?
AI infrastructure defense is security for the moment an AI system acts, not the moment it thinks. It sits between the AI's decision and the action that decision would trigger. Every proposed action is checked against your policy before it reaches the system it would touch. Mountain Theory builds AI infrastructure defense for enterprises.
How do you stop an AI agent from taking a harmful action?
You stop it at the execution layer, by checking the action before it runs. Filtering the prompt does not help once the model has already decided. Mountain Theory evaluates each action against policy and returns one of three outcomes: ALLOW, HOLD or BLOCK. The action does not execute until it has been checked.
What happens when an AI agent is authorized but wrong?
Authorization is the problem, not the protection. A compromised or manipulated agent uses the exact permissions you granted it, so identity and access controls see nothing unusual. The gap is between what the agent is allowed to do and what it should do right now. Mountain Theory closes that gap by checking each action at the point of execution.
What is the execution layer in AI security?
The execution layer is where an AI system's decision becomes a real action. It is the step after the model produces output and before an API call, a database write, a payment or a message actually happens. Most AI security operates before this point, on prompts and outputs. Control at the execution layer is what determines whether an action occurs.
How is this different from prompt filtering?
Prompt filtering inspects language. Execution control inspects actions. A filter can miss a manipulation, and once the model is convinced, the filter has nothing left to catch. An execution check does not care how the agent was persuaded, because it evaluates the action itself against policy. The two operate at different layers and are not substitutes.
Does this require a human to approve every action?
No. Mountain Theory runs autonomously by default. HOLD is an option you switch on for the actions you choose, not a requirement. You decide where a person steps in, and everything else is checked and allowed to proceed without waiting on anyone.
How do you write policy without writing code?
Policy is written in plain English. You describe what the AI is allowed to do, and in what circumstances, in the same language you would use to brief a person. That policy is what each action is checked against.
Is AI agent activity auditable?
Yes. Every decision is recorded with who or what proposed the action, what was proposed, when, what the outcome was, and why. The record is append-only, so it can be used as evidence. This is built for SOC 2, ISO 27001, PCI DSS, GDPR, HIPAA, FERPA, CMMC and CCPA programs.
Which AI models does this work with?
Mountain Theory is model agnostic. It sits at the execution layer, so it does not depend on which model produced the decision, or on that model's provider, version or hosting.
Who is Mountain Theory for?
Mountain Theory is enterprise-first. The strongest fit is organizations where an AI acting wrongly has physical or regulatory consequences: public safety and NG911, defense, financial services, healthcare, education under FERPA, and disaster response.
How do you secure an AI workflow?
You secure an AI workflow by controlling what it is allowed to do at the point of execution, not by reviewing it afterwards. Each step a workflow tries to take is checked against policy before it runs, so a workflow that is manipulated mid-run still cannot act outside what you allowed. Logging alone does not secure a workflow, because it tells you what happened after it already happened.
What is a prompt injection attack, and how do you defend against it?
A prompt injection attack hides instructions in content an AI reads, so the AI follows the attacker instead of you. The content can be a web page, a document, an email or a calendar invite. Defending it by inspecting language alone is unreliable, because the attack succeeds by looking legitimate. The durable defense is at the execution layer: even if the AI is convinced, the action it then attempts is still checked against policy before it runs.
What is agentic AI security?
Agentic AI security is protecting systems where an AI takes actions on its own rather than only producing text. The risk changes because the AI now has permissions, tools and reach into other systems. The control that matters is over the actions it takes, since the same permission that makes an agent useful is what makes a compromised agent dangerous.
Can an AI agent be trusted with production systems?
An AI agent can be trusted with production systems when its actions are constrained by something outside the agent itself. Trust based on the model behaving well is not a control, because the model can be manipulated and its behavior changes between versions. Mountain Theory places the constraint outside the agent, so the boundary holds regardless of what the agent was persuaded to attempt.
Does Mountain Theory replace my existing security tools?
No. Mountain Theory covers a layer your existing tools do not reach. Identity and access management decides what an AI is permitted to do. Monitoring records what it did. Neither one stops a permitted action that should not happen right now. Mountain Theory sits at that gap and leaves the rest of your stack in place.
How do you prove to an auditor that an AI system is under control?
You prove it with a record of every action the AI proposed, the policy it was checked against, the outcome, and the reason. Mountain Theory produces that record as an append-only log, so it stands up as evidence rather than as a report someone assembled afterwards. That is what an auditor asks for under SOC 2, ISO 27001, HIPAA, FERPA and CMMC.
What is inline AI runtime security?
Inline AI runtime security means the control sits in the path the AI actually runs through, rather than watching from the side. If a check is not inline, it can only report what already happened. The distinction that matters is where inline sits: some products are inline on the prompt and the response, and some are inline on the action. Mountain Theory is inline on the action, between the decision and the thing that decision would do.
What is an AI firewall?
An AI firewall inspects traffic to and from a model and blocks content that breaks a rule. It is a content control: it looks at what goes in and what comes out. It does not evaluate the action a model then takes, because by that point the traffic has already passed inspection. An authenticated agent issuing a destructive command is not a content problem, so a firewall is the wrong layer to stop it.
Do I need AI guardrails or execution control?
Guardrails and execution control solve different problems and most enterprises need both. Guardrails stop a model from saying something unsafe. Execution control stops an agent from doing something unsafe. A jailbreak filter does not stop an authenticated agent from deleting a database, because nothing unsafe was said. If your AI only produces text, guardrails may be enough. If it takes actions, they are not.
What is non-human identity (NHI) security?
Non-human identity security governs the credentials that machines use: API keys, service accounts, OAuth tokens and now AI agents. It answers who an agent is and what it is permitted to do. It is necessary and it is upstream of the problem here. Identity solves attribution, and it authorizes the agent once at the start of a session. It cannot help when a correctly identified agent, with valid credentials, does the wrong thing.
What is AI security posture management (AI-SPM)?
AI security posture management discovers your AI assets, maps their risk, and reports what is misconfigured or exposed. It gives you the inventory and the risk picture. It is a visibility layer, so it tells you what your exposure looks like rather than intervening in the moment. Posture answers what could go wrong. Execution control answers what happens when it does.
What is MCP security?
MCP security protects deployments of the Model Context Protocol, the standard that lets AI models call external tools and data sources. The risk is that MCP hands an agent real reach into real systems. Securing the protocol matters, and so does governing the action once a tool call is made. Mountain Theory checks the action itself against policy, regardless of whether it arrived over MCP, an API, or a framework calling a function directly.
Is AI red teaming enough to secure an AI system?
No. AI red teaming finds weaknesses before deployment and it is worth doing. It is testing, so it tells you what an attacker could achieve at a point in time, against the model as it was that day. It does not stop anything in production. Models change, attackers adapt, and a finding does not become a control until something enforces it at runtime.
What is an AI gateway?
An AI gateway brokers traffic between users and models, usually to apply data loss prevention, masking, or access rules at the boundary. It works at the perimeter, between the person and the model. That is a useful place to protect data. It is not where an autonomous agent acts, because an agent operating inside your systems is already past the perimeter when it decides to do something.
What is agent goal drift?
Agent goal drift is when a multi-step AI agent gradually moves away from the task it was given, often because something in its context pushed it. Detecting drift means reasoning about intent, which takes time and is probabilistic. Checking the action is deterministic: the action either matches policy or it does not. Both approaches have a place, but only one gives a definite answer before the action runs.
What is deterministic policy enforcement for AI?
Deterministic policy enforcement means the same action against the same policy always produces the same decision, with no model inference in the decision path. It matters because a probabilistic control cannot be audited: you cannot show a regulator a control that might behave differently next time. Mountain Theory is deterministic at the point of enforcement, and the policy behind it is written in plain English rather than code.
What is the difference between AI governance and AI security?
AI governance is the policy, documentation and oversight that says what your organization permits. AI security is what actually enforces it. Governance produces the rule and the evidence trail. Without enforcement it is a document, because nothing stops the action when the moment comes. Mountain Theory is the enforcement half, and it produces the evidence governance needs as a byproduct.
What is an AI circuit breaker?
An AI circuit breaker sits between an AI system's decision and the action it would trigger, and stops the action when it breaks policy. The name comes from electrical engineering: the breaker does not judge the appliance, it opens the circuit when current crosses a threshold. Applied to AI, it means the action does not execute until it has been checked. That is the architecture Mountain Theory is built on.