Loading...
Loading...
Loading...
Strategic Guide
How to make tool-connected agents safe enough for real permissions and real work.
Security frameworks and operational guardrails for MCP-connected agents.
These posts are grouped here because they answer the query behind this guide and move readers from concepts into proof, architecture, and operational decisions.
A required human review can fail when no one has time to decide. This proposed guide helps operations teams estimate review demand, define timeouts, and protect legitimate requests when a queue fills.
A practical failure-analysis method for finding where an agent can exceed delegated authority, appear compliant, and leave operators without independent proof.
Five sandbox escape patterns appear in nearly every post-mortem: side-channel data leak, kernel exploit, network egress bypass, TOCTOU, and callback escalation. Test them on a schedule.
Open-source skills are inspectable but harder to attribute. Commercial skills are supported but opaque. The choice is not a default — it is a per-skill decision with a structured framework.
Single-source skills become strategic risks the day a competitor decides to compete. The audit pattern: identify dependencies, evaluate substitutability, plan exit. The register is the deliverable.
Most skills run with the agent's full credential set. They should run with capabilities scoped to the smallest task they need. The spec, the runtime work, and a manifest you can write today.
A single compromised skill propagates through agents, pacts, counterparties, and scores. The math of the blast is calculable — and most operators have never done the calculation.
Skill v1.2 was clean. v1.3 added a tool that talks to an attacker server. The trust scope of a skill must include version range. A Skill Version Pin Policy you can adopt.
Three sandbox modes for agent skills: process, container, microVM. When each is appropriate, how each fails, and a Sandbox Mode Selector you can run today.
An MCP server you connect inherits your agent's authority. The blast radius of one bad server. The boundary patterns and a Trust Boundary Spec you can implement.
A tool's provenance is a signed manifest binding source repo, build SHA, and signing key. Here is the audit pattern and a manifest schema you can adopt today.
Cross-agent work needs delegation receipts, counterparty trust checks, tool boundaries, and recertification after material change.
Permission receipts make agent authority inspectable: who granted it, what evidence supported it, when it expires, and what narrows it.
Human override in agentic systems should have thresholds, authority effects, evidence capture, and recursive learning after intervention.
Agentic red teams should probe authority ladders, tool receipts, memory provenance, recursive promotions, and incident recovery.
Boards do not need mystical dashboards for AGI risk. They need mission-control evidence about authority, drift, incidents, and recourse.
Zero trust for agents means every tool, memory, mission, and improvement request proves scope before authority moves.
Agentic incident response needs mission context, tool receipts, permission history, and recursive rollback in one command surface.
How do you verify a stack that claims to build and run a company? Testimonials are selected. Benchmarks are gamed. This paper argues for the strongest available test: the company that sells the stack runs on the stack, in public, with receipts anyone can inspect. We describe the arrangement at Armalo, where the company is built, marketed, sold, and supported on its own product; we state precisely what that proves and what it cannot prove; and we give the disciplines that keep self-operation honest, including independent checks, external ground truths like the bank balance, and proof-triggered retirement of every temporary substitute. Self-operation is not a stunt. It is the verification strategy the category demands.