Assume the agent can be manipulated.

AgentSecurity does not trust model intent as proof of authorization. It evaluates the authenticated tenant, agent, action, resource, arguments, policy and approval state before execution.

Default deny

Unknown agent, inactive agent, undiscovered action, policy mismatch and unavailable authorization all prevent execution.

Enforcement levels

Intercept

The SDK wraps verified local framework hooks.

Enforce

The trusted gateway owns credentials and executes allowlisted connectors.

Isolate

An approved sandbox profile adds process, network and resource restrictions.

Honest limitation

No local wrapper can secure a second unwrapped tool reference or credentials retained by a compromised process. Use server-side enforcement for high-impact operations.