Current agentic AI architectures are fundamentally incompatible with the security and epistemological requirements of high-stakes scientific workflows. The problem is not inadequate alignment or insufficient guardrails, it is architectural: autoregressive language models process all tokens uniformly, making deterministic command--data separation unattainable through training alone. We argue that deterministic, architectural enforcement, not probabilistic learned behavior, is a necessary condition for trustworthy AI-assisted science. We introduce the Trinity Defense Architecture, which enforces security through three mechanisms: action governance via a finite action calculus with reference-monitor enforcement, information-flow control via mandatory access labels preventing cross-scope leakage, and privilege separation isolating perception from execution. We show that without unforgeable provenance and deterministic mediation, the ``Lethal Trifecta'' (untrusted inputs, privileged data access, external action capability) turns authorization security into an exploit-discovery problem: training-based defenses may reduce empirical attack rates but cannot provide deterministic guarantees. The ML community must recognize that alignment is insufficient for authorization security, and that architectural mediation is required before agentic AI can be safely deployed in consequential scientific domains.
Towards trustworthy agentic AI: a comprehensive survey of safety, robustness, privacy, and system security
Faculty of Engineering, Department of Computer Science and Engineering, The Chinese University of Hong Kong（香港中文大学工程学院、计算机科学与工程系）；Artificial Intelligence Innovation and Incubation Institute, Fudan University（复旦大学人工智能创新与孵化院）；Shanghai Academy of AI for Science（上海人工智能科学研究院）
The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents
Sir Syed CASE Institute of Technology（Sir Syed CASE 理工学院）；University of Engineering and Technology（工程与技术大学）；National Textile University（国立纺织大学）；King Fahd University of Petroleum and Minerals (KFUPM)（法赫德国王石油与矿物大学）
Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
Department of Electrical and Electronics Engineering（电子与电气工程系）；Birla Institute of Technology and Science, Pilani, Pilani Campus（比拉理工学院和科学学院，比拉校区）；Department of Computer Engineering, KIIT University（计算机工程系，KIIT大学）；Quantum Cloud Computing and Distributed Systems (qCLOUDS) Laboratory（量子云计算与分布式系统（qCLOUDS）实验室）；Department of Computing and Information Systems（计算与信息系统系）；The University of Melbourne（墨尔本大学）
SoK: Agentic Retrieval-Augmented Generation (RAG): Taxonomy, Architectures, Evaluation, and Research Directions
University of North Dakota（北达科他大学）；Youngstown State University（青年州大学）；University of Toledo（托莱多大学）；University of Missouri（密苏里大学）；Tribhuvan University（特里布文大学）
