Training-time alignment doesn’t secure a deployed agent. That’s the argument at the center of Google DeepMind’s AI Control Roadmap, published June 18, 2026. The framework treats autonomous AI agents the way enterprise security teams treat privileged human employees: assume they can be compromised, monitor their reasoning at runtime, and build hard stops before a bad action becomes an irreversible one.
The conceptual shift matters as much as the architecture. Most current agentic security thinking focuses on guardrails baked into training, RLHF, constitutional AI, refusal training. DeepMind’s framework argues that’s insufficient for deployed agents operating in real environments with access to tools, APIs, and sensitive data. Runtime containment is the gap. The roadmap fills it with three layers.
The first layer is the Supervisor Agent, a secondary model that performs “contrastive safety search” on the primary agent’s reasoning states in real time. According to DeepMind, this approach reduced jailbreak success rates by 94% in internal evaluations. That figure is self-reported and hasn’t been independently verified. Read it as a directional signal, not a benchmark.
The second layer is Cryptographic Provenance. Every agent action is cryptographically signed, creating a tamper-evident audit trail. If an action can’t be verified against its provenance signature, the kill switch triggers. This is the framework’s most practically significant element for enterprise teams, it’s not a new concept in security, but applying it to agent action chains in production is.
Agentic Security Approach
The third layer is the threat taxonomy itself, which DeepMind maps to MITRE ATT&CK. Treating agent compromise vectors (prompt injection, tool misuse, context poisoning) as documented attack patterns, the same way security teams catalog adversary techniques against human-operated systems, changes how you scope the defense. It also creates a common vocabulary for red-teaming agentic deployments.
Don’t expect this to solve the supply chain problem. The roadmap addresses runtime behavior of a controlled agent. It doesn’t cover cross-organization agent identity federation, or what happens when your supervised agent calls an external agent you don’t control. That gap is real, and none of the three major agentic security frameworks published this month closes it.
According to DeepMind, the framework was informed by analysis of 1 million coding agent tasks. That corpus is the basis for the monitoring baseline, understanding what normal agent behavior looks like before you can flag anomalous behavior. The methodology behind this analysis is DeepMind’s own; no external validation is available.
DeepMind’s roadmap also includes an economic projection of $2.9 trillion in potential US value from agentic AI by 2030, though the methodology behind this figure was not disclosed. It’s context for the stakes, not a forecast to cite.
Unanswered Questions
- What is the inference overhead of running a Supervisor Agent alongside a primary agent in high-frequency workflows?
- How does Cryptographic Provenance handle agent actions taken across external APIs the deploying organization doesn't control?
- Does the MITRE ATT&CK mapping cover prompt injection vectors specifically, or only post-compromise lateral movement?
The catch is implementation complexity. A Supervisor Agent that monitors another agent’s reasoning states in real time adds latency and compute cost to every production deployment. DeepMind doesn’t disclose the inference overhead. For teams running high-frequency agentic workflows, that’s the first question to answer before adopting this architecture.
Enterprise teams building agentic systems now have three published security frameworks from frontier labs and infrastructure vendors to work with, Databricks’ Omnigent (governance layer), Beyond Identity’s Ceros (identity/trust layer for MCP), and DeepMind’s Control Roadmap (runtime supervision). Each covers a different layer. None covers all three. The practical question isn’t which framework to adopt. It’s which layer your current deployment leaves most exposed.