Hugenroth et al. isolate a trusted observer inside a TEE (AWS Nitro Enclaves) from sandboxed, untrusted build execution, binding declared inputs and output digests to attestation evidence. Galanou et al. extend runtime attestation using eBPF/LSM enforcement, IMA measurements, and protected evidence recording inside an AMD SEV-SNP confidential VM.
Their policy-driven architecture captures build inputs, execution events, and configuration changes, linking artifacts and SBOMs to hardware-backed evidence without
requiring changes to existing build toolchains. They exemplify two approaches to extend the HW RoT to runtime: Hugenroth minimizes the trusted observer while isolating build execution; Galanou protects the mechanisms that enforce policies and record runtime state.
This connects the build provenance problem in Kettle with the architectural concern in Designing Trustworthy Layered Attestations: the mechanisms that observe execution and produce evidence must themselves be protected. For attested builds, the layers need to connect the measured environment to a trustworthy observer, the build’s inputs and execution, and ultimately its output artifacts.
Protecting an attestation signing key against extraction is insufficient if a compromised component can still invoke it to endorse fabricated evidence. The authors propose
TPM policy and locality-based authorization, and recommend Linux/SELinux changes to bind TPM commands to particular security contexts. Similarly, moving LKIM outside the
kernel being measured can remove problematic cyclic trust relationships between measurer and measured system.
This generalizes nicely beyond runtime attestation. For example, for attested builds (see Kettle), a constrained builder with bounded inputs, short-lived workers, limited interactions, and
policy-enforced execution is fundamentally easier to make meaningful claims about than a generic CI runner supporting arbitrary execution and persistent state.
While TLS authenticates a service identity and attestation tells you an environment is approved, clients can’t be certain that the TLS session actually in use terminates
in the expected environment. SessionLatch proposes using a trusted observer inside CVMs to prove session-endpoint correspondence.
This observer produces TEE-bound evidence which clients can fetch via a separate control channel as the handshake proceeds, holding (latching) client encrypted records
until the evidence verifies and frees up the data path.
The Linux implementation relies on a userspace observer using SOCK_DIAG, nftables/NFQUEUE and other OS facilities. A measured/enforced eBPF or similar kernel mechanism
could potentially provide a stronger reference monitor and bind the session to richer workload identity.
More broadly, the paper illustrates why endpoint attestation becomes harder as the TEE boundary expands from process enclaves to entire confidential VMs.
I recently went over two articles from March-May 2026 that highlight how we must always assume that aligned models can make unexpected decisions. Perplexity’s Security Considerations for Artificial Intelligence Agents develops a layered defense strategy; Christodorescu et al.’s
Agent Security Is a Systems Problem treats the model as untrusted and enforce security invariants outside it.
A boundary that holds only when the model correctly interprets an instruction or recognizes an attack is a behavioral expectation, not an enforceable restriction. Moving enforcement outside the model is necessary, but letting the same untrusted model freely define its own policy would recreate the original dependency. The articles recognize open research problems including verifiable translation of user’s intent from natural language into enforceable constraints.
Taking the untrusted model assumption seriously changes how we design agents. A model-generated tool call is a request for authority, not proof of authorization. These requirements become harder when the workflow itself emerges at runtime, rather than following a program whose resource needs are known in advance. There are excellent analogies in here for people working on code integrity, particularly dynamic/JITted code security.
Related designs explore how to enforce these boundaries: aflock places authorization and evidence generation in an external MCP server, while Grimlock uses eBPF-mediated sandbox boundaries and attested channels to enforce identity and constrain delegation outside agent code. Many of the projects I’m tracking in the bureado/awesome-agent-runtime-security collection are attempting to tackle this angle.
AIBoMGen makes that possible by restricting the training environment. Users provide inputs and parameters rather than arbitrary code or shell access, allowing the platform
to remain an independent observer of a constrained workflow. This limits generality and leaves trust in the platform, workers, signing keys, containers, and cloud control
plane, but demonstrates a broader principle: trustworthy provenance may require constraining execution enough that evidence generation cannot simply be bypassed.
For a related approach to authenticating ML transformation history with hardware-backed attestation and transparency logs, see my notes on Atlas.
The core takeaway is that many systems already have a shared secret anchored
in trusted hardware, such as a SIM or TPM, and infrastructure that already
knows how to derive and manage keys from it.
The authors propose reusing that existing trust: derive an
application-specific secret, make it available through a KDC and trusted
transfer agent, use it for TLS or DTLS PSK authentication—otherwise the
dominant source of resource consumption and handshake unreliability—and keep
ML-KEM for ephemeral post-quantum key establishment and forward secrecy.
This avoids dragging large post-quantum certificates and signatures across
constrained devices and lossy links. The authors observed about 70% less
handshake bandwidth and roughly one-third the energy consumption. The broader
takeaway is that, in some scenarios, post-quantum readiness may not require
rebuilding the authentication stack if the system already has a scalable
symmetric root of trust.
The paper shows how Thompson-class attacks aren’t restricted to compilers by
tampering with strip in the NixOS bootstrap seed. The malicious strip
repurposes PT_NOTE as PT_LOAD, and the payload propagates into later
generations of strip rebuilt from clean source. All but one binary in
stdenv ends up infected, without breaking the build or functional tests.
I walked away thinking about diverse artifact structure verification:
population-level artifact checks run from independent trust roots, with
independently built parsers and tooling. Could we come up with a stable ELF
morphology of a distribution and use that to detect a coordinated structural
shift across thousands of unrelated binaries?
For a related approach to detecting compiler subversion, see my notes on
Rosencrantz’s Diverse Double-Compiling (DDC),
including the challenges of extending verification across a real build graph.
The core argument is that coding agents have crossed the threshold where mandatory human code review is no longer economically justified. Human review consumes an
estimated 10–15% of developer time, and scaling code generation while keeping humans as the approval gate simply moves the bottleneck downstream.
Readers might find the implication for SCM architecture most interesting. GitHub/GitLab-like platforms may need first-class agent identities, cryptographically attributable
actions, specialized permissions, structured findings and confidence, and machine-readable review artifacts—not agents impersonating humans through comment threads. Agent
review also seems better described as auditable and replayable than deterministic.
This suggests code review may evolve from a human synchronization gate into continuous agentic assurance, with human inspection becoming a risk-based escalation path in
some scenarios.
The core idea in Grimlock is separation of concerns for high-agency systems: agent code handles orchestration, while the sandbox
substrate enforces identity, authentication, authorization, provenance, and least-privilege delegation. Much of this is established security architecture; what I found
interesting is how the pieces are composed while leaving agent code unchanged.
eBPF provides no-bypass, application-transparent mediation at the sandbox boundary and associates ordinary socket flows with stable sandbox identities. Guard-to-guard
communication uses TLS 1.3 with kTLS for the data plane, allowing authentication context and longer-lived channels to amortize setup costs.
Post-handshake attestation is of special note. TLS exporters bind fresh TEE evidence to an already-established channel, including nonce, audience,
and requested delegation scope. Successful appraisal produces short-lived, channel-bound Scope Tokens that the destination guard revalidates before releasing plaintext to
the destination sandbox.
Beyond Zero: Enterprise Security for the AI Era establishes that the application is no longer a sufficient trust boundary. Beyond Zero
pushes authorization down to individual actions on individual resources, with contextual risk decisions running at machine speed. What’s new since BeyondCorp is fusing
static authorization guarantees with dynamic AI reasoning without turning security into a fully probabilistic system.
The mechanism is essentially a continuous feedback loop: an enterprise security world model precomputes context about users, agents, roles, resources, and expected work;
event intake adds endpoint, server, and agent signals, including prompts, plans, and tool invocations; a hierarchical reasoning engine then feeds allow, deny, challenge,
or containment decisions directly back into authorization. Expensive inference is front-loaded so thousands of decisions per second can remain low-latency.
This also collapses the traditional separation between access management and security operations: investigations can happen continuously and immediately change the actor’s
“access bubble.” Challenges add granular friction under ambiguity; containments contract authority when risk increases. More broadly, this suggests that machine-speed
agentic systems may require security to become a closed-loop authorization system rather than a monitoring layer around applications.