What is an AI agent on an endpoint?
An AI agent is software that takes a goal in plain language and then acts on it in steps: it reads files, runs commands, installs packages, calls tools and sends data to a model. On an endpoint, those steps run with the access of the person who started the agent. A coding agent in a developer's terminal can read the same source code, the same cloud credentials and the same SSH keys the developer can. A desktop agent can open the same documents and the same browser sessions.
That is the difference from the AI tools of two years ago. A chatbot in a browser tab answers questions. An agent on a device does things, and it does them faster than a person would review them.
What does the control layer do?
Products in this category describe three jobs, in different words. The first is finding agents: which coding agents, desktop agents, MCP servers, extensions and tools are installed across the fleet, and what each can reach. The second is setting rules about capabilities: whether an agent may run a shell, install a package, call a cloud CLI or connect to a given MCP server. The third, and the one this site weights most, is deciding on a single action at the moment the agent tries it: allow it, stop it, ask a person, or change it.
Bay describes the three jobs as See it, Know it and Rule it. Noma Security describes discovering endpoint agents such as Claude Code, Cursor and Codex with their MCP servers and skills, then blocking unauthorized ones. Zenity describes monitoring what a coding agent reads, runs, installs and sends, and blocking or modifying a dangerous tool call before it executes. The vocabulary differs; the jobs are the same.
How does it relate to EDR?
EDR watches processes, files and network activity for malware and intrusion. It is good at noticing that a process did something suspicious. It was not designed to know that a shell command came from an agent rather than a person, that the agent was following an instruction hidden in a web page, or that the user would have said no if asked. Agentic endpoint products add that layer. Several of them deploy through the EDR or MDM already on the device, which is a sign of how they see the relationship: alongside, not instead.
Why does the category exist now?
Two things have changed. Coding agents and desktop agents are now part of daily work at many companies rather than pilots, and standards bodies have started writing about agent control directly. The OWASP GenAI Security Project's 2026 Top 10 for LLM Applications ranks Excessive Agency third and announced work on an Agent Control Standard aimed at runtime enforcement. Buyers now ask a sharper question than whether AI is in use: what is it allowed to do, and who decides.
What this school covers
The next three lessons cover the decision itself: stopping an action before it runs, the six kinds of verdict a product can return, and agents that run beyond the laptop. The buying track covers rollout paths, platform owners versus standalone vendors, named agent lists and what to ask for when public detail is thin. The last track covers capability rules and a staged rollout.