Least Privilege Execution

Rather than assigning broad role-based permissions, the agent receives an unforgeable token (a capability) that grants access to a specific object and operation. This inverts the access control model from 'who you are' to 'what you can hold.'

• A capability might grant read:file/xyz but not list:directory
• Aligns with object-capability (ocap) security models used in secure operating systems
• Prevents confused deputy attacks where an agent abuses ambient authority

A declarative policy that explicitly enumerates which external tools, APIs, and functions an agent is authorized to invoke. Any call to a tool not on the list is blocked at the Policy Enforcement Point (PEP).

• Example: An agent may call send_email but not delete_user
• Policies are defined as code using Open Policy Agent (OPA) or similar engines
• Provides a definitive audit trail of all permitted actions for compliance review

Uses the Linux kernel's seccomp-bpf facility to restrict an agent's process to a precise allowlist of system calls. If a compromised agent attempts a forbidden syscall like mount or ptrace, the kernel immediately terminates the process.

• Reduces the kernel attack surface from hundreds of syscalls to fewer than 50
• Prevents container escape techniques that rely on obscure kernel interfaces
• Profiles can be generated automatically via tools like strace during testing

Maps the agent's root user (UID 0) inside its container to a high-numbered, unprivileged UID on the host (e.g., UID 100000). Even if an attacker achieves a container escape, they land as a user with zero privileges on the host system.

• Enabled by default in rootless container runtimes like Podman
• A critical defense-in-depth layer against kernel exploits
• Works in conjunction with Pod Security Admission policies in Kubernetes

Every agent task runs in a fresh, single-use environment created from an immutable, known-good image. The environment—including memory, disk, and network state—is completely destroyed upon task completion, leaving no residual state for an attacker to persist in.

• Implemented via MicroVMs like Firecracker or WebAssembly (Wasm) sandboxes
• Prevents state contamination between tasks and eliminates persistent backdoors
• Enables deterministic replay for forensic analysis of security incidents

A security posture where an agent has no permanently assigned permissions. All access rights are dynamically granted, scoped to the exact task, and immediately revoked upon completion. This eliminates the risk of long-lived credential theft.

• Just-in-Time (JIT) Access: Credentials are ephemeral, often lasting seconds.
• Eliminates credential harvesting: There are no static keys to steal.
• Dynamic scoping: Permissions are bounded by the specific API call being made.

A security policy that explicitly defines which external tools, APIs, and functions an autonomous agent is authorized to call. This is the direct implementation of least privilege, preventing unauthorized actions and limiting the blast radius of a prompt injection attack.

• Deny-by-default: Any tool not on the list is blocked.
• Parameter schemas: ACLs often validate the arguments passed to a tool.
• Context-aware: Policies can change based on the task's risk level.

The practice of writing security and compliance rules in a high-level, machine-readable language (like Rego for OPA). This allows for version-controlled, automatically enforced authorization decisions at the moment an agent attempts an action.

• Declarative logic: Define what is allowed, not how to enforce it.
• Auditability: Every policy change is tracked in Git history.
• Unified enforcement: The same policy can gatekeep agents, services, and human users.

A component in the system architecture that intercepts a request from an agent and enforces an authorization decision before the action reaches a protected resource. It acts as the physical gate that consults the Policy Decision Point (PDP).

• Integration point: Often a sidecar proxy or API gateway.
• Non-bypassable: All traffic must flow through the PEP.
• Decoupled logic: The PEP enforces the decision but doesn't make it.

A security protocol that grants an agent ephemeral, short-lived credentials to access a specific resource only at the moment it is needed. This eliminates standing privileges and reduces the window of opportunity for a compromised agent.

• Brokered access: A central secrets vault generates temporary tokens.
• Automatic expiry: Credentials are useless after a TTL (Time To Live) elapses.
• Request justification: Often tied to a specific task ID for audit trails.

A security control that prevents an agent from executing any binary, script, or process that is not on a pre-approved list. This blocks unauthorized code from running even if a tool-calling vulnerability is exploited.

• Kernel-level enforcement: Often implemented via eBPF or Seccomp.
• Hash validation: Only executables with a known cryptographic hash are allowed.
• Defense in depth: Complements network egress filtering.