Who signs off when an agent drafts your firewall change?

On 27 October 2026, Help Net Security reported that FireMon has built agentic AI capabilities into its network security management platform, making agents "first-class citizens alongside practitioners" on policy work (Help Net Security, 27 October 2026). FireMon CEO Jody Brazil framed the reasoning plainly: "Network security has never been more complex, and the answer isn't more infrastructure" (Help Net Security, 27 October 2026).

What happened

The release adds named agents to specific jobs. An Intelligent Agent searches and analyses policy data, building Security Intelligence Query Language queries behind the scenes so practitioners can ask questions without writing them. A Network Designer Agent turns an access requirement, such as HTTPS access to a reporting service, into firewall policy recommendations. A Policy Change Designer Agent carries a request through discovery, recommendation and preparation of a staged Policy Plan change, pausing whenever a practitioner has to choose between valid options (Help Net Security, 27 October 2026).

FireMon is explicit that nothing an agent prepares reaches a firewall on its own. A Policy Plan change sits until a human reviews and accepts it, and acceptance saves the work to the workflow rather than deploying it. The platform also exposes a FireMon MCP Server, so external agentic workflows can retrieve policy data and stage changes through the Model Context Protocol, gated by roles and credentials. Customers choose their own large language model, including one run inside their own environment, and AI enablement is off by default (Help Net Security, 27 October 2026).

That is a careful design. It is also, by FireMon's own account, unproven at scale: the article's claim that the agents save "thousands of hours" of work carries no supporting data (Help Net Security, 27 October 2026).

Why this is not an isolated move

FireMon is applying a pattern that is already showing up across security tooling: give an agent read access to operational data, let it reason over that data, and let it draft the consequential artefact for a human to approve. The appeal is obvious. Firewall estates span multiple vendors, cloud environments and segmentation layers, and a single access request can touch several devices with more than one valid way to satisfy it. Gathering and evaluating that by hand is slow, which is exactly the gap FireMon is selling into.

The risk sits one layer below the workflow diagram, in the identity the agent itself holds. Orchid Security's framing of agent deployments generally applies directly here: "the agent is approved, the studio is approved, but the identities behind them sit outside the usual review process," and permissions tend to "accumulate" past an agent's original job as integrations are added over time (Roy Katmor, Orchid, via [[agent-credentials-nobody-reviews]]). An agent that can query policy data across every connected firewall vendor and stage changes through an MCP server is carrying meaningful reach, whatever the human-approval gate around its output looks like.

The broader governance gap is already measured, not hypothetical. Reco's State of Agent Security 2026 (26 August 2026), built from enterprise telemetry and analysis of 500 public Model Context Protocol servers, found 80% of AI tools running with no oversight at all. That figure covers AI tooling generally, not network security specifically, but it describes the same shape of problem FireMon is now introducing into policy management: an agent with read and stage access to sensitive infrastructure data, and no settled answer for who reviews what it was permitted to reach.

What it means for a regulated enterprise

An agent that can search policy data and prepare firewall changes is, functionally, a new identity with access to the network's access-control plane. Under NIS2, cybersecurity risk management carries personal management accountability, and a staged change prepared by an unreviewed agent identity is the kind of operational risk that obligation is meant to cover. The EU AI Act's record-keeping expectations assume an organisation can say what a system did and on what authority; an MCP server exposing policy data to external agentic workflows needs that record to exist by architecture, not by after-the-fact reconstruction.

The practical question for a security or compliance lead is not whether the human-in-the-loop gate exists. FireMon has built one. It is whether the organisation can answer, for any given agent connected to that MCP server: which credential it used, what scope that credential actually carries across every connected firewall vendor, and whether the staged change it prepared matches what it was authorised to touch.

What actually addresses it

The mechanism that closes this gap is the same one that closes it for any agent: an identity issued to the agent itself, scoped to the systems it needs and nothing wider, with a record of every credential use kept where a reviewer can read it rather than take on faith. Scoping has to cover the MCP server connection specifically, since that is the path through which an external agent reaches staged policy data, and role and credential controls on that server are only as good as the review process behind the roles they grant.

An append-only audit ledger, kept separate from the agent's own reporting, is what lets a security team compare what an agent was authorised to query against what it actually queried, and revoke a single agent's access in seconds if the two diverge, without pulling the firewall platform itself offline.

What to check on Monday

Before any agentic capability touches firewall policy, four questions are worth answering in writing: which identity does the agent use to reach the policy platform and the MCP server, who issued that identity and when it was last reviewed, what is the full scope of systems that identity can reach today versus what it was given for, and where is the log that would show a regulator, six months from now, exactly which staged change came from an agent rather than a person. If any of those four has no answer, the human-approval gate is reviewing an output without being able to audit the reach that produced it.

How AANCER answers

AANCER issues each Certified Agent a signed passport from a per-install certificate authority rather than letting it inherit a borrowed credential, so a policy-querying agent carries a named, scoped identity rather than a shared service account. That passport states the tools and data the agent may reach and is revocable in under 30 seconds, without redeploying the agent or the systems it talks to.

Every credential use is written to an append-only, tamper-evident audit ledger, so a security team can compare what an agent was scoped to query against what it actually queried. AANCER's connector layer, mapped across 725 connectors, lets that scoping extend to infrastructure platforms such as policy management tools without granting the agent a standing account on each one, and approval workflows gate the consequential step so a human decision sits on record alongside the agent's recommendation.

Sources

• Help Net Security, "FireMon Agentic AI helps teams investigate access and prepare policy changes", 27 October 2026: https://www.helpnetsecurity.com/2026/10/27/firemon-agentic-ai/
• Roy Katmor, Orchid Security, cited in [[agent-credentials-nobody-reviews]]
• Reco, State of Agent Security 2026, 26 August 2026, cited in [[ungoverned-prompt]]