AAEF framework treats model output as proposal, not authority

Kazuma Horishita argues that AI agent security requires more than making models safer — when agents can call tools, update records, send messages, or delegate tasks, every action must be authorized, bounded, attributable, and evidenced. The article introduces AAEF (Agentic Authority & Evidence Framework), a public review draft and GitHub project focused on that narrower control problem. A key concern is prompt injection: a malicious instruction embedded in an email, document, or retrieved context could cause a model to emit a tool call that the system then blindly executes. AAEF counters this by separating an authorization layer (is this action allowed?) from a tool dispatch layer (should this tool actually be invoked with these arguments?), ensuring policy and system state — not natural-language model output — govern execution.