Notes: Grimlock: Guarding High-Agency Systems with eBPF and Attested Channels

The core idea in Grimlock is separation of concerns for high-agency systems: agent code handles orchestration, while the sandbox substrate enforces identity, authentication, authorization, provenance, and least-privilege delegation. Much of this is established security architecture; what I found interesting is how the pieces are composed while leaving agent code unchanged.

eBPF provides no-bypass, application-transparent mediation at the sandbox boundary and associates ordinary socket flows with stable sandbox identities. Guard-to-guard communication uses TLS 1.3 with kTLS for the data plane, allowing authentication context and longer-lived channels to amortize setup costs.

Post-handshake attestation is of special note. TLS exporters bind fresh TEE evidence to an already-established channel, including nonce, audience, and requested delegation scope. Successful appraisal produces short-lived, channel-bound Scope Tokens that the destination guard revalidates before releasing plaintext to the destination sandbox.