The core idea in Grimlock is separation of concerns for high-agency systems: agent code handles orchestration, while the sandbox
substrate enforces identity, authentication, authorization, provenance, and least-privilege delegation. Much of this is established security architecture; what I found
interesting is how the pieces are composed while leaving agent code unchanged.
eBPF provides no-bypass, application-transparent mediation at the sandbox boundary and associates ordinary socket flows with stable sandbox identities. Guard-to-guard
communication uses TLS 1.3 with kTLS for the data plane, allowing authentication context and longer-lived channels to amortize setup costs.
Post-handshake attestation is of special note. TLS exporters bind fresh TEE evidence to an already-established channel, including nonce, audience,
and requested delegation scope. Successful appraisal produces short-lived, channel-bound Scope Tokens that the destination guard revalidates before releasing plaintext to
the destination sandbox.
Beyond Zero: Enterprise Security for the AI Era establishes that the application is no longer a sufficient trust boundary. Beyond Zero
pushes authorization down to individual actions on individual resources, with contextual risk decisions running at machine speed. What’s new since BeyondCorp is fusing
static authorization guarantees with dynamic AI reasoning without turning security into a fully probabilistic system.
The mechanism is essentially a continuous feedback loop: an enterprise security world model precomputes context about users, agents, roles, resources, and expected work;
event intake adds endpoint, server, and agent signals, including prompts, plans, and tool invocations; a hierarchical reasoning engine then feeds allow, deny, challenge,
or containment decisions directly back into authorization. Expensive inference is front-loaded so thousands of decisions per second can remain low-latency.
This also collapses the traditional separation between access management and security operations: investigations can happen continuously and immediately change the actor’s
“access bubble.” Challenges add granular friction under ambiguity; containments contract authority when risk increases. More broadly, this suggests that machine-speed
agentic systems may require security to become a closed-loop authorization system rather than a monitoring layer around applications.
I maintain
Awesome Agent Runtime Security,
a Linux-focused curation of long-form writing, specifications, and technologies
at varying levels of maturity. It collects approaches to kernel- and
hypervisor-enforced agent isolation, secrets injection, and deriving
credentials from an agent’s measured state.