Governing a 50-agent fleet with
cryptographic identity and graduated trust

The Problem

This Fortune 500 financial services company had deployed 50 autonomous AI agents across four departments: compliance, customer support, research, and operations. Each agent had its own responsibilities, data access patterns, and cost profiles. But they all shared the same API key.

The CISO's audit revealed the nightmare scenario: a research agent with access to public market data was using the same credential as a compliance agent with access to customer PII. If the research agent was compromised via prompt injection, the attacker could use that shared credential to exfiltrate customer data through any other agent in the fleet. This is Semantic Lateral Movement — the AI-native equivalent of network lateral movement, and traditional firewalls are mathematically blind to it.

Budget visibility was equally broken. Monthly AI spend had ballooned to $180K with no way to attribute costs to individual agents or detect runaway spending until the invoice arrived. One agent in a hallucination loop consumed $14K in a single weekend.

The Solution: Five-Pillar Governance

BrainstormRouter replaced the shared API key with a complete governance stack. The integration required one line change per agent — pointing the OpenAI SDK at api.brainstormrouter.com.

Cryptographic Identity: Each of the 50 agents received a unique SPIFFE identity backed by ephemeral mTLS certificates with 5-minute lifetimes. If an agent is compromised, the blast radius is mathematically contained to a 5-minute window. No static API keys. No long-lived tokens. The research agent's identity is cryptographically distinct from the compliance agent's — lateral movement is structurally impossible.

// Before: shared API key, no identity
client = OpenAI(api_key="sk-shared-company-key")

// After: per-agent cryptographic identity
client = BrainstormRouter(
    api_key="br_live_agent_research_01",
    base_url="https://api.brainstormrouter.com/v1",
    client_cert="/certs/research-01.pem",
    client_key="/certs/research-01.key"
)

Graduated Trust Degradation: Instead of binary kill switches, the CISO configured proportional response. When an agent's anomaly score rises, BrainstormRouter doesn't terminate it — it degrades operating conditions through four trust levels:

Virtual Corporate Cards: Each agent received its own budget envelope. The compliance agents got $500/day. Research agents got $200/day. Support agents got $100/day. When the limit is hit, the circuit breaks. No exceptions. The $14K weekend incident became structurally impossible.

The Incident That Proved the System

Six weeks after deployment, a research agent received a carefully crafted prompt injection hidden in a financial document. The injected instructions attempted to invoke a tool call to query the customer database — a resource outside the research agent's Semantic RBAC manifest.

The Streaming Firewall caught the unauthorized tool invocation mid-stream, before the tool call reached its destination. The connection was severed. A synthetic LLM refusal was injected: "I am not authorized to perform this action." The agent's trust level was automatically degraded from FULL to RESTRICTED. Its mTLS certificate was flagged for accelerated rotation.

The Evidence Ledger recorded the complete chain: who acted (research-agent-07, SPIFFE ID spiffe://brainstorm.internal/agent/acme/ra-07), what was attempted (tool call to customer_db.query), what policy was active (manifest v3, read-only financial data), what the system decided (BLOCK, severity HIGH), and what remediation occurred (trust degraded to RESTRICTED, cert flagged).

The CISO's security team reviewed the incident within 30 minutes. The agent was cleared after 3 consecutive clean verdicts automatically restored its trust to FULL. Total customer data exposed: zero bytes.

Agent Fleet Distribution (90-Day Snapshot)

Results

Monthly AI spend dropped from $180K to $108K — a 40% reduction. The savings came from two sources: budget caps prevented runaway spending (accounting for $28K/month), and graduated trust degradation automatically routed anomalous agents to cheaper models rather than terminating them (saving an estimated $44K in lost productivity).

More importantly, the CISO achieved what no traditional security tool could provide: a complete, cryptographically signed audit trail proving exactly which agent took which action, under which policy, with which authorization, at what cost. When the board asked "are our AI agents governed?", the answer was not a slide deck. It was a live Evidence Ledger with 2.3 million signed decision records.

The team wrote zero custom governance code. Every enforcement boundary — identity, authorization, trust degradation, budget limits, evidence — was configured through BrainstormRouter's API, not built from scratch.