MA
← Selected systemsENGINEERING CASE STUDY

Runtime execution integrity · agent authorization

AgentGuard

A runtime authorization and execution-integrity boundary for autonomous agent actions. It protects the gap between policy approval, credential issuance, the exact action that executes, and the evidence left behind.

Security objectiveAuthorized action == credentialed action == executed action
ArchitectureProvider-neutral modular monolith · ports & adapters · deterministic core
Runtime invariantAuthorized Action == Credentialed Action == Executed Action
CORE QUESTION
Is this exact action safe to execute?
Owns · Runtime action authorization + execution integrity

Security invariant

Authorization, credential, and execution must describe the same action.

Runtime boundary

The full authorization-to-execution chain.

Threat transitions

Security failures happen in the handoffs.

01

Argument mutation

AUTHORIZED / EXPECTEDauthorized refund(order=123, amount=50)
ATTEMPTED DRIFTattempted refund(order=124, amount=500)
02

Credential overreach

AUTHORIZED / EXPECTEDscope ≤ approved authority
ATTEMPTED DRIFTcredential requests broader tenant / audience / TTL
03

Replay

AUTHORIZED / EXPECTEDsingle bounded authorization
ATTEMPTED DRIFTsecond worker attempts the same permit
04

Bypass

AUTHORIZED / EXPECTEDguarded MCP route
ATTEMPTED DRIFTparallel direct route attempts to skip mediation

Engineering decisions

Security is created by refusing ambiguous authority.

DECISION 01

Authorization stays deterministic

A probabilistic model cannot be the final security boundary.

TRADE-OFF

Less flexible than model-judged policy; materially stronger guarantees.

DECISION 02

Credentials never exceed the authorized action

A correct policy decision is insufficient if the issued credential is broader than the decision.

DECISION 03

Revalidate at execution time

The action that executes must be compared against the action that was authorized, not merely against an earlier request object.

Capability surface

What AgentGuard owns at runtime.

01Canonical ActionIntent
02Deterministic default-deny policy
03Signed decision receipts
04Bounded approvals
05Credential ceilings
06Execution-time revalidation
07Replay protection
08MCP enforcement boundary
09Audit integrity

Benchmark surface

What the system is designed to measure.

MEASUREMENT CONTRACT

The runtime boundary is measured by the security properties it preserves under mutation, replay, concurrency, and dependency failure.

Adversarial intent mutation, replay races, credential-ceiling tests, fail-closed dependency faults, and protected execution load tests.
01Auth overheaddecision + verification latency
02Mutation rejectionargument / tenant / target drift
03Replay rejectionreceipt + approval + nonce reuse
04Credential ceilingscope · audience · TTL invariants
05Concurrency safetysingle-use execution under races
06Audit integritytamper / truncation detection

Evidence

Publicly defensible system evidence.

SignalEvidenceInterpretation boundary
Authorization boundaryDeterministic policy · default deny · explicit allow / deny / approvalSupportedNo LLM decides authorization.
Decision integritySigned, request-bound decision receipts + bounded approvalsSupportedApproval cannot widen the original requested authority.
Credential ceilingAudience · scope · tenant · TTL constrained to authorized contextSupportedCredential authority must remain less than or equal to authorized authority.
Execution integrityCanonical intent recomputation + mutation detection + nonce/replay controlSupportedExecution is revalidated against the authorized action before protected action dispatch.
Protocol boundaryMCP enforcement posture + tool-schema freshness + bypass-route detectionSupportedOnly traffic routed through the enforcement boundary can be mediated.
Audit integrityCorrelated request/decision/approval/credential/execution/outcome evidenceSupportedPublic case study exposes architecture and bounded evidence, not private implementation secrets.

Explicit boundaries

Execution integrity is narrower than “agent security.”

Not an identity providerNot a generic vaultNot a SIEMNot a model-alignment systemNot a general sandbox