Writing · AI Security

Auditable by design: what open source teaches about securing agentic AI

By Mahmoud Lotfy · Jul 2026 · 7 min read

The core risk of agentic AI is not that a model is wrong. It is that the model acts, on real systems, with authority a person granted it, through logic nobody can see. When enterprises let an agent move money, change access, or approve a transaction, they are trusting a decision process they cannot inspect. That is not a new problem. It is the exact question open source answered decades ago: can you audit the thing you depend on? Auditability, not accuracy, is the control that makes autonomy safe to grant.

I spend most of my time on the human layer of security, the point where a confident output gets trusted and acted on. Agentic AI moves that point earlier and makes it faster. The human is still in the loop, but the loop is now "approve or reject a recommendation from a system I do not understand," at machine speed, many times a day. If you cannot see how the recommendation was formed, approval stops being a decision and becomes a reflex.

The black box problem

A chatbot that answers a question is low stakes. If it is wrong, a person reads the answer and moves on. An agent is different in kind, not degree. It talks to systems and performs tasks: it files the ticket, sends the message, updates the record, triggers the payment. In one of the Tencast conversations, Bashar Al-Abdulhadi described exactly this shift at Kuwait Net, moving past chatbots to AI agents that autonomously talk to people and act on websites. That is where the industry is heading, and it is the right direction. It is also where the security model has to change.

The problem with an autonomous agent is that its reasoning is opaque by default. It acts on your systems, but the logic that produced the action lives inside a model you did not build and cannot read. When something goes wrong, and eventually something will, you are left reconstructing intent from outputs. You cannot patch a decision you cannot see, and you cannot govern a process you cannot inspect. Opacity is the vulnerability. Everything downstream of it, prompt injection, tool misuse, silent data exposure, is a symptom.

Open source as an audit surface

This is where a decades-old debate becomes newly relevant. Bashar makes a distinction I keep coming back to: open source is not free of charge, it is freedom of use. The value was never the price. It was that anyone could read the code, understand it, adapt it, and verify what it actually does. Community-auditable technology is not a fringe preference. It is the backbone of the modern web. He cites the figure that WordPress alone powers about 42% of the web, evidence that transparent, inspectable technology is already the standard the internet runs on, not the exception.

"Open source isn't free of charge. It's freedom of use."

Translate that into a security requirement and it reads cleanly: the systems you grant authority to should be inspectable. Not necessarily open source in the licensing sense, but auditable in the operational sense. You should be able to see what an agent is allowed to do, what it actually did, and why. Bashar frames open source as the region's route to digital sovereignty, a way to own your infrastructure instead of renting a foreign black box you are told to trust. The same argument applies to AI agents. Owning the audit surface, the logs, the tool permissions, the decision trail, is how you keep sovereignty over a system that is acting on your behalf.

From transparency to trust

Transparency is not the goal. Trust is. Transparency is how you earn it. The bridge between the two is scope: an auditable agent is only safe if its authority is bounded to what it actually needs. This is the idea I build Excera around, human risk intelligence scoped to authority. Every actor, human or machine, should be briefed and bounded to exactly what they can authorise: moving money, granting access, approving an agent's action. An agent with unbounded scope and opaque logic is the worst of both worlds. An agent with bounded scope and a readable decision trail is something you can actually govern.

The lesson open source teaches is that you do not have to choose between capability and control. WordPress did not win because it was cheap. It won because organisations could see inside it and make it theirs. Agentic AI will earn enterprise authority the same way, by being inspectable enough that granting it authority is a decision, not a leap of faith.

A checklist before you grant authority

Before you let an AI agent act on a system that matters, pressure-test it against a few questions. Can you see, after the fact, exactly what it did and in what order? Can you see why, in terms a reviewer could follow, or only that it happened? Is its authority scoped to a specific task, or does it inherit broad standing permissions? If it were compromised or manipulated, what is the blast radius, and would you find out in minutes or months? Can a human meaningfully review its high-stakes actions, or is approval a rubber stamp on an output nobody understands?

If the answers are uncomfortable, the fix is not a better model. It is a more auditable one. The organisations that get agentic AI right will treat auditability as a precondition for authority, the same way the web already treats inspectable software as the default. You can inspect what you trust, or you can trust what you cannot inspect. Only one of those is a security posture.