I recently went over two articles from March-May 2026 that highlight how alignment can improve an agent’s behavior, but security must hold even when the model makes the
wrong decision. I found these reads valuable grounding for thinking about agent architectures.
The latter posits the model’s learned judgment should not be part of the TCB, because the model is inherently probabilistic, and we can’t have a probabilistic TCB. A
boundary that holds only when the model correctly interprets an instruction or recognizes an attack is a behavioral expectation, not an enforceable restriction.
The papers identify concrete open research problems, including verifiable policy generation: translating a user’s evolving natural-language intent into enforceable constraints.
Moving enforcement outside the model is necessary, but letting the same untrusted model freely define its own policy would recreate the original dependency.
Taking the untrusted-model assumption seriously changes how we design agents. A model-generated tool call is a request for authority, not proof of authorization. These
requirements become harder when the workflow itself emerges at runtime, rather than following a program whose resource needs are known in advance. There are excellent
analogies in here for people working on code integrity, particularly dynamic/JITted code security.
Related designs explore how to enforce these boundaries: aflock places authorization and evidence generation in an external MCP server, while
Grimlock uses eBPF-mediated sandbox boundaries and attested channels to enforce identity and constrain delegation outside agent code.
The core idea in Grimlock is separation of concerns for high-agency systems: agent code handles orchestration, while the sandbox
substrate enforces identity, authentication, authorization, provenance, and least-privilege delegation. Much of this is established security architecture; what I found
interesting is how the pieces are composed while leaving agent code unchanged.
eBPF provides no-bypass, application-transparent mediation at the sandbox boundary and associates ordinary socket flows with stable sandbox identities. Guard-to-guard
communication uses TLS 1.3 with kTLS for the data plane, allowing authentication context and longer-lived channels to amortize setup costs.
Post-handshake attestation is of special note. TLS exporters bind fresh TEE evidence to an already-established channel, including nonce, audience,
and requested delegation scope. Successful appraisal produces short-lived, channel-bound Scope Tokens that the destination guard revalidates before releasing plaintext to
the destination sandbox.
Beyond Zero: Enterprise Security for the AI Era establishes that the application is no longer a sufficient trust boundary. Beyond Zero
pushes authorization down to individual actions on individual resources, with contextual risk decisions running at machine speed. What’s new since BeyondCorp is fusing
static authorization guarantees with dynamic AI reasoning without turning security into a fully probabilistic system.
The mechanism is essentially a continuous feedback loop: an enterprise security world model precomputes context about users, agents, roles, resources, and expected work;
event intake adds endpoint, server, and agent signals, including prompts, plans, and tool invocations; a hierarchical reasoning engine then feeds allow, deny, challenge,
or containment decisions directly back into authorization. Expensive inference is front-loaded so thousands of decisions per second can remain low-latency.
This also collapses the traditional separation between access management and security operations: investigations can happen continuously and immediately change the actor’s
“access bubble.” Challenges add granular friction under ambiguity; containments contract authority when risk increases. More broadly, this suggests that machine-speed
agentic systems may require security to become a closed-loop authorization system rather than a monitoring layer around applications.
aflock applies familiar ideas from SPIFFE/SPIRE, in-toto, capability systems, and policy engines to agent
execution. Rather than trusting an agent to report its own behavior, aflock moves authorization and evidence generation into an external MCP server. Agent identity is
derived from introspectable properties; short-lived JWTs convey authority; and the server signs attestations with keys the agent never sees.
Policies can constrain individual actions and cumulative properties of an execution trajectory. Session attestations are committed through a Merkle tree to provide
ordering and completeness evidence, while Rego evaluates cross-attestation constraints. Hierarchical sub-agent delegation uses in-toto-style sublayouts with mandatory
attenuation, so delegated authority cannot exceed the parent’s constraints.
The broader systems principle is compelling: securing autonomous agents may require treating execution trajectories much like software supply chains—externally
constrained, cryptographically recorded, and recursively verifiable—rather than relying on the agent itself to enforce or describe its boundaries.
I maintain
Awesome Agent Runtime Security,
a Linux-focused curation of long-form writing, specifications, and technologies
at varying levels of maturity. It collects approaches to kernel- and
hypervisor-enforced agent isolation, secrets injection, and deriving
credentials from an agent’s measured state.