AI agents are creating an awkward problem for enterprise security because knowing which software is making a request does not necessarily establish whether the action it is about to perform should be allowed, a gap that newly launched Outerlimit wants to address at the point of execution.

Outerlimit has emerged from stealth with $16 million in pre-seed funding from AlbionVC, Evolution Equity Partners, and Crane Venture Partners. Operating from London and New York, the company is building a security and authorisation layer intended specifically for AI agents able to use tools, APIs, accounts, and enterprise systems.

The company was founded by Tony Pepper and Neil Larkins, who previously built email-security business Egress before its acquisition by KnowBe4 in 2024, together with Peter Vincent, a theoretical neuroscientist with academic experience at University College London.

Outerlimit’s central argument is that conventional identity and access management was designed around users and applications whose permissions could largely be assessed before an action occurred. An agent behaves differently because it can interpret information, plan several steps, invoke tools, interact with other software, and change its next action according to what happens during execution.

The company therefore wants to place authorisation around the tool call itself. Rather than assuming that an agent with a valid identity should retain broad permission throughout a task, Outerlimit says policy, identity, and execution context can be checked when an individual action is requested.

Identity is not the same as permission

Zero Trust security developed around the principle that access should not be granted merely because a user or device sits inside a trusted network. Modern implementations evaluate identity, device status, permissions, and other contextual signals before giving access to a system or piece of information.

Agents extend the problem because one authorised system can carry out several very different actions during the same workflow. An expense agent might legitimately read a receipt, update an accounting record, and initiate part of a payment process, while the same agent could later attempt an unrelated export of data because of a faulty instruction, compromised tool, or malicious content encountered during its work.

Prompt-level restrictions can reduce some of that risk but are not equivalent to deterministic access controls. Language models generate probabilistic outputs and may interpret instructions differently depending on context, while prompt injection can introduce new instructions through documents, websites, messages, or other data an agent is allowed to process.

Outerlimit’s proposed architecture separates reasoning from enforcement. The model can decide what it wants to do, but another control evaluates whether the requested action complies with policy before the underlying tool receives the credentials or permission required to execute it.

The company describes that approach as extending Zero Trust to the “agent action layer”. The terminology is Outerlimit’s own, but the underlying distinction is concrete because an allow-or-deny decision applied during execution does not depend on the model remembering and correctly interpreting a written rule about its behaviour.

Discovery comes before enforcement

Outerlimit is structuring its product around discovery, observation, enforcement, and later policy optimisation. The first stage inventories agents, models, tools, MCP servers, and other action surfaces, addressing a familiar security problem in which a new technology can spread across an organisation faster than the team responsible for governing it.

Observation is intended to record interactions and tool calls, creating an audit trail that security and compliance teams can use to reconstruct activity. Enforcement then applies policy when a tool is invoked, while a planned optimisation layer is intended to analyse the accumulated information and suggest changes where permissions are unnecessarily broad or rules create avoidable friction.

That sequence reflects the maturity of enterprise agent adoption. Many organisations are still trying to establish which AI systems employees and developers have connected to internal information, making inventory and observation useful even before the business is willing to let agents perform consequential actions autonomously.

The architecture also creates a substantial integration requirement for Outerlimit. Enterprise agents can be built through different model providers, orchestration frameworks, identity systems, cloud environments, applications, and tool protocols, meaning a common enforcement layer becomes more valuable as its coverage widens but simultaneously harder to implement consistently.

The company says its approach is agent- and platform-agnostic and can operate through infrastructure placed inside the customer’s environment. It also says it is working with large enterprises, although the launch material does not name those customers or publish independently verified production benchmarks.

A security layer has to stay out of the way

The size of the pre-seed round reflects investor interest in security infrastructure around autonomous AI, but funding does not establish that Outerlimit’s particular architecture will become a standard. Identity vendors, cloud companies, cybersecurity suppliers, AI platforms, and enterprise-software providers are all developing controls around agent permissions and runtime behaviour.

A standalone layer therefore has to justify itself against capabilities customers may eventually receive from suppliers already embedded in their technology estate. Cross-platform consistency could provide one advantage if businesses prefer a single policy system spanning agents from several vendors rather than a separate enforcement method for every application.

That advantage will depend on performance as well as integration breadth. Authorisation sits directly in an execution path, so security checks need to be reliable and fast enough not to turn autonomous workflows into a slow sequence of remote approvals.

Failure behaviour also matters. An enforcement layer needs a predictable response when a policy service is unavailable, an identity cannot be established, credentials cannot be reconstructed, or an agent chains several tools together while the organisation changes a permission during the task.

Auditability may become as valuable as blocking because companies deploying agents into finance, customer records, software development, infrastructure, or regulated processes will need to reconstruct what autonomous systems did after an incident. That means knowing which agent initiated an action, what tool was used, which policy applied, and whether the execution was allowed or denied.

Outerlimit has raised substantial capital to build that layer before enterprise agent deployments have fully matured, giving it an opportunity to influence the architecture while the market is still forming. The company still has to demonstrate that its approach works across heterogeneous production systems without creating a new bottleneck or single point of failure.

The underlying security problem is less speculative. As businesses give agents access to more tools and data, the question becomes increasingly specific: not whether an AI system should be trusted in general, but whether a particular action, using a particular tool and set of credentials, should be permitted at that moment. Outerlimit is building around that distinction; production evidence will show whether enterprises need the additional layer to enforce it.