Muhammad Atashi
Agent security · runtime authorization · execution integrityPRIVATE CORE

AgentGuard

AgentGuard is a controlled execution boundary for actions routed through it. The dispatched action must match the authorized action, credentials stay inside that decision, and an uncertain external effect stays unresolved until reconciliation.

Owns
Authorizes tool execution and enforces runtime boundaries fail-closed
Status
Core v0.2.0rc4 · release-candidate engineering validation. Production certification is not claimed.
Stack
Python · Policy v2 · MCP · Ed25519 · SQLite · Audit
Public Reference

agentguard-reference 0.1.0 is a minimal public reference implementation. It is separate from AgentGuard Core v0.2.0rc4 and is not a newer Core release.

Hard problem

The action that executes should still be the action that was authorized.

Question · Can this exact action still prove that it is the action that was authorized?

APPLIES TO

AI Platform Teams · AI Security Teams · Agent Infrastructure Engineers · Security-sensitive enterprise AI teams

PROOF

Default-deny authorization · bounded credentials · execution revalidation · reconcile-before-retry

CAPABILITIES

9 declared in the project record

  • Canonical ActionIntent
  • Deterministic default-deny policy
  • Signed decision receipts
  • Bounded approvals
  • Credential ceilings
  • Execution-time revalidation
  • Replay protection
  • MCP enforcement boundary
  • Audit integrity

Architecture

The operating path.

  1. 01Intent

    canonical tool · resource · tenant · arguments

  2. 02Authorize

    default-deny deterministic policy

  3. 03Clamp

    credential scope · audience · tenant · TTL

  4. 04Revalidate

    live action + freshness + replay checks

  5. 05Dispatch

    protected MCP execution boundary

  6. 06Bind Effect

    persist external-effect identity before uncertainty

  7. 07Reconcile

    provider truth before retry

  8. 08Evidence

    correlated tamper-evident outcome

Execution binding

Mutate the action. Watch dispatch stop.

Authorization is not treated as a historical fact. The live action is checked again at execution.

01

Authorized

refund(order=123, amount=50)

Deterministic policy. Default deny.

02

Credentialed

scope ≤ authorized · TTL bound

Credential cannot exceed the decision.

03

Executed

revalidated intent · nonce held

The action that runs is the action that was allowed.

Authorized = Credentialed = Executed

Attempted drift

refund(order=124, amount=500)

Waiting for the binding to complete before a mutated request is tried.

Engineering decisions

The constraints that matter.

01

Authorization stays deterministic

A probabilistic model can propose an action, but it cannot be the final authority that allows that action to execute.

02

Authority is clamped before credentials exist

A correct policy decision is not enough if the execution credential can still exceed the approved tenant, audience, scope, or lifetime.

03

The live action is revalidated at dispatch

Approval of an earlier request object does not prove the tool call that reaches the boundary is still the same action.

04

UNKNOWN is reconciled before retry

A provider timeout may hide a successful external effect; retry safety depends on provider truth, not caller certainty.

Measurement contract

What would make the preferred answer fail?

EVALUATION METHOD

Runtime security is measured by whether authorized intent remains bound to constrained authority, admitted dispatch, and the external effect that actually occurred.

Intent mutation, replay races, credential-ceiling tests, ambiguous provider outcomes, stale-reconciler schedules, durable effect bindings, and audit verification.

01

Mutation rejection

arguments · tenant · target · scope drift
02

Replay rejection

receipt · approval · nonce reuse
03

Credential ceiling

scope · audience · tenant · TTL
04

Ambiguous effects

UNKNOWN preserved until reconciliation
05

Retry safety

provider truth checked before repeat dispatch
06

Audit integrity

correlated and tamper-evident execution evidence

Validation

What the evidence actually supports.

Claims stay scoped

Authorization boundary

SUPPORTED

Deterministic default-deny policy with signed, request-bound decisions

No LLM is trusted as the authorization authority.

Execution integrity

SUPPORTED

Credential ceilings · live action revalidation · nonce/replay protection

Protection applies to execution routed through the guarded boundary.

Ambiguous external effects

SUPPORTED

Effect binding persists before dispatch; provider reconciliation precedes retry

The design prevents timeout from being treated as proof of failure.

Engineering release candidate

SUPPORTED

v0.2.0rc4 covers protected MCP stdio + bounded Streamable HTTP and durable reconciliation

Independent security review, long-duration validation, and controlled pilot evidence are not claimed.

Authorization-lineage research

NOT CLAIMED

Preregistered DEV harness covers replay, stale reconciliation, provider ambiguity, and durable-ledger baselines

Confirmatory trials and research conclusions are not claimed.

Boundaries

— Not an identity provider— Not a generic vault— Not a SIEM— Not a model-alignment system— Not a general sandbox
← Selected systemsNext · InferenceLedger