Mark McLaughlin, Product Marketing Manager | Aurascape
September 15th, 2026 | 🕐 5 minute read

Introduction

Aurascape defines Intentions as the capabilities, modes, or actions available inside an AI application or agent. The Intentions available vary by the AI tool: from simple chat to summarizing documents, creating a file, generating code, browsing the web, calling a connector, acting as an agent, and hundreds more. The risk of a data leak or a threat changes a great deal with the Intentions involved. A summary of an uploaded file and a tool call are quite different actions from a security standpoint, even when these actions occur inside the same application under the same login.

Intentions matter more today because AI tools now often pick the mode themselves. The assistant decides to browse, call a tool, or switch into agent mode based on what it reads as the goal of the task, not necessarily because the user toggled those modes on. This means the user may not even realize riskier or more expensive Intentions are being used to accomplish their tasks. And when hundreds or thousands of users interact with AI across an organization, this grows into a blind spot for security, IT, and compliance teams. The trouble is, blocking an entire AI tool because of a few risky or expensive modes inside it also removes the safe, productive work the tool was adopted for.

Intention-based policy for AI solves this problem: you can set guardrails for the riskiest or most expensive Intentions, while allowing safe, normal use of the rest of the AI tool’s capabilities.

One application, many Intentions

Network security grew up on destinations: a URL category, an app ID, a port. That worked because a destination’s activities were few and well known. The file-sharing site uploaded, downloaded, shared. Policy could enumerate those activities and enforce on them.

An AI application does not behave one way. Here’s an example. In one session, an employee may ask the AI for a summary, then a code review, then hand it a file, and the assistant moves into agent mode on its own to work through it, calling the GitHub connector. One application and one login, four activities with four different risk profiles: a summary of public material, a review of proprietary code, an uploaded file, and an agent interacting with sensitive systems. Is the entire session risky? Is the entire session safe? Neither question has a clear yes or no answer.

Where app-level policy goes wrong

Telling these activities apart takes visibility into the interaction itself: the prompts, the responses, and the calls the AI makes on the user’s behalf. Traditional security tools act primarily on destinations, identities, and data patterns, because those are the fields they were built to read.

But app-level allow or block rules cannot tell a harmless summary from a code review or an agentic action chain. The control is too blunt. Businesses need their people to be able to use powerful AI tools, and blocking them outright is not an answer. It hurts productivity, frustrates users, and inevitably ends with savvy users finding workarounds or requesting exceptions en masse.

Block the application, and the research and summarizing that save people real time disappear, all because a few edge-case capabilities are risky or overly expensive. Allow the application, and the dangerous agent mode sneaks in with the helpful summarization. Wholesale block or allow both fail at what the business and its end users want: to get work done safely.

Security teams saw a version of this problem before AI, with the proliferation of SaaS, and cloud access security broker (CASB) activity controls were the answer: they recognize a known application’s activities, upload, download, share. AI modes surface inside the interaction itself, as conversations run their course.

A reason traditional security struggles here comes down to communication protocols and streaming. An AI response arrives token by token over long-lived connections, on protocols such as WebSockets, Streamable HTTP, and QUIC, and an agentic coding session can hold a connection open for a long time. Most traditional security tools cannot decode these protocols at all, or support only a handful of applications, which leaves three bad options: terminate the session, pass it through uninspected, or block the application. Each costs the business something: a broken tool, a blind spot, or lost productivity. It’s vital to decode the stream inline and keep it intact through inspection, so the response the employee is watching keeps flowing and the policy still applies as various Intentions are invoked during sessions.

Intentions decide cost as well as risk

Risk is not the only thing that changes with the Intention. Cost changes too. An agent run or a long research task consumes far more than a chat turn, and the models available inside an application differ in price as well. As adoption spreads, the bill climbs with the models used, and with the Intentions the tool chooses for them.

Most employees are not trying to waste money. They just do not know the difference, or forget to downgrade models or disable connectors for simpler tasks. Asking IT to keep tabs on every mode and model in every AI app does not scale. Policy on Intentions does: set the guardrail once on the costliest modes and models, coach the user in real time, and offer a cheaper way to get the same work done.

How Aurascape sets Intention-level policy

Aurascape sits inline, decodes the AI interaction, and identifies the Intention in play: chat, summarize, file upload, code generation, browsing, connector use, tool calls, agent mode, and hundreds more. This is intention-level AI security: policy attached to the mode in use, evaluated with the user, the application, the account type, and the data involved.

Two important notes on Intentions:

1. An Intention is a capability of the application: the modes above are observable behaviors of the software. An Intention describes the application’s mode, not necessarily the user’s motive. If the AI tool tries to take a risky or expensive means to accomplish a task, the user may not realize why the action was interrupted by policy. This is why Aurascape offers real-time coaching when securing end users: customizable templates that tell users exactly why the action is risky, and coach them to safer behavior to get their work done.
2. Intentions are application-specific: a coding assistant and a chatbot expose different modes. The set of Intentions that matters for a tool follows from what that tool can do, which is why an inventory that classifies each app’s capabilities comes first.

These two points are why proactive, always-on discovery and decoding for AI is vital. This builds an up-to-date AI inventory. From there, automated processes interrogate AI tools to discover the available Intentions within them, making granular intention-based policy and coaching possible.

Policy actions can allow a permitted action and still flag it for admin review. They can coach, with customizable templates. They can notify users in real time and require them to confirm a risky or expensive action before it proceeds. They can redact sensitive data from a prompt before it reaches the AI service. Coaching can redirect a user to the sanctioned tool or the correct account license when sensitive data is detected, before any of it leaves. And policy can block dangerous actions and threats, with a real-time explanation for the user.

The same idea extends to agents. In agent mode, an Intention can lead to action: a tool call with consequences in an external system. That is why the Zero-Bypass MCP Gateway marks every Model Context Protocol (MCP) tool call it approves, while the AI Proxy reads the exchange between the agent and its model and checks for that mark. With the agent’s model traffic steered through the proxy, a call that skipped the Gateway is blocked before the model acts. What the AI was asked to do and what it did with tools become one connected record.

---

The sanctioned app stays available, with the risky and expensive elements controlled. To see the level of granular control you can get for the AI tools your teams use, book a demo. For the one-page version you can hand to your team, see the Intentions At-a-Glance.