Security
Zero Trust for agent identity and execution.
Verify explicitly, apply least privilege and assume breach across identity, model, tool, workload, data and evidence boundaries.
Control design
Enforcement reaches the actual point of action.
| Enforcement point | Control function | Failure posture |
|---|---|---|
| API gateway / broker | Validate passport, scope, target, obligations and revocation. | Fail closed for protected or high-impact actions. |
| Agent tool interceptor | Evaluate individual tool calls and route approvals. | Block unknown tools; cache only short-lived low-risk decisions. |
| Kubernetes admission / sidecar | Validate workload identity, image, region and runtime limits. | Reject non-compliant workloads; quarantine drift. |
| Model gateway | Restrict provider, version, prompt handling and data class. | Block unapproved model substitution. |
| Business adapter | Enforce transaction, case, procurement or record-level conditions. | Hold and open review on critical exceptions. |
Threat model
Design against identity, delegation, runtime and evidence attacks.
Agent impersonationCPID verification, proof-of-possession, short-lived credentials and issuer/status checks.
Token replayNonce/audience binding, expiry, replay detection, workload binding and mTLS where appropriate.
Delegation launderingVisible delegation graph, authority ceiling, sponsor and no self-escalation.
Model substitutionModel Passport, endpoint/version allowlist and approval gates.
Workload driftImage digest, admission control, attestation and material-change triggers.
Evidence tamperingSigned events, append-only storage, hashes, controlled retention and immutable audit patterns.
Fail-safe rule
When identity, signature, status, policy, workload context or safe operating conditions cannot be verified, restrict, defer, isolate or escalate rather than continue autonomously.