What is the difference between a security framework and a security control?

One tells you what should be true. The other makes it true at the moment an agent acts.

Anthropic’s Zero Trust guidance for AI agents is the clearest articulation any major lab has put on record. Cryptographically rooted identity, permissions scoped per task, memory protected against poisoning, defensive operations that move at the speed of autonomous attackers. It draws the map well.

What is striking is what happened next. Within weeks, a wave of vendors lined up to answer a single question the framework does not: how do you enforce it at runtime? The design test buried in the guidance is the sharp bit · does a control make an attack impossible, or merely harder? An agent has infinite patience. Friction it will simply outlast.

Which is the whole game. A permission scope written into a policy document is intent. A permission scope that rejects the tool call at dispatch is control. The distance between those two is where most agent security actually lives right now, and it is wider than the frameworks make it look.

The labs describing the threat model this precisely is genuine progress. The next move belongs to everyone deploying agents: proving the control fires when it counts, not just that it was written down.

Where in your stack is the check that can actually halt the action?