Summary
- Salt Workflows links detection with controls such as gateways and access management systems.
- Actions include revoking agent permissions, applying blocks and correcting configuration gaps.
- Availability depends on customer integrations, chosen policies and migration to the new workflow experience.
Salt Security has extended its Agentic Security Platform with automated enforcement capabilities intended to act on identified threats and configuration risks through controls already present in an organisation’s environment. The new Autonomous Defense functionality uses Salt Workflows to trigger measures such as revoking access, blocking suspicious API traffic or initiating remedial configuration changes.
The platform’s security graph maps AI agents, Model Context Protocol servers, software tools and downstream APIs alongside information about exposure and runtime behaviour. Salt says this context can be used to decide which defensive action is appropriate when a particular agent has excessive permissions, an API is exposed or a known attack pattern is detected. A finding can therefore feed an enforcement process rather than producing only an alert or an incident ticket.
One use case is removing a risky connection between an AI agent and a tool. Another is issuing a targeted blocking rule to a web application firewall or API gateway when abuse is detected. Configuration actions can include reinstating rate limits or approved security settings. These examples involve different systems and privilege requirements; the platform needs a supported integration and sufficient administrative rights before it can execute a change.
Salt describes configurable approval thresholds, allowing some findings to trigger immediate containment while other actions wait for a person to authorise them. Automatic enforcement also has the potential to interrupt legitimate services. Blocking a heavily used endpoint on incomplete evidence, or revoking a legitimate service identity during a critical transaction, may create operational consequences even if the security system acted exactly as configured.
Salt has added a visual workflow builder and says more than 200 connectors are available across security, IT and collaboration systems. Each integration provides supported actions, while workflow permissions and approval rules determine whether the platform can block API traffic, revoke an agent connection, change a setting or send a notification. This allows containment processes to use controls that an organisation already operates, without routing every system through a single gateway.
Salt Workflows is available to customers, and the company is moving existing configurations into the updated interface. A workflow can connect detection of an exposed API or overprivileged AI agent to a targeted action at the relevant gateway, identity service or security control. Automatic containment, approval-gated changes and audit logging can operate within the same response process, with the selected enforcement point determining which action takes effect.
