Enforcing intent-based access control at the endpoint

In the Odyssey, the Sirens promised every passing sailor the story of "everything that is going to happen over the whole world." Circe warned Odysseus that their listeners never made it home, but he wanted to hear the song anyway. He also knew he couldn't trust himself once he did. So he stopped his crew's ears with wax, had them bind him upright to the mast, and gave them one standing order: "If I beg and pray you to set me free, then bind me more tightly still." When the song came, he signaled with his brows for his men to let him go, and Eurylochus and Perimedes tied him tighter. The song is what people remember, but the engineering worked. Odysseus set his limits before the temptation arrived, and he left its enforcement to ropes he couldn't loosen and men who couldn't hear him.

The previous piece covered turning an agent's prompt into an access policy that a person validates. This piece covers whether that policy holds once the agent starts working. Three questions define the design. Can the agent tamper with the controls enforcing the policy? Does the control check the action regardless of how the agent attempts it? And does it receive enough task context to understand intent while staying simple enough to test? These questions connect controls a security vendor can build on endpoints today with broker, resource-side, and hardware enforcement elsewhere.

OpenAI demonstrated the problem while hardening its training environment. In Securing our frontier model training environment, published October 23, it reports that teams of agents "found several ways to chain vulnerabilities into microVM escapes." In a separate experiment, agents passed synthetic secrets between microVMs through the processor's cache, without network connections or shared writable files. OpenAI gave the attacking agents infrastructure source code and configuration details. In most communication tests, researchers also pointed them toward a specific channel or supplied a method for encoding and decoding messages. OpenAI says it remediated the discovered weaknesses and its frontier training now runs without live internet access.

Other containment failures took different forms. In Marchand et al.'s SandboxEscapeBench, which seeds containers with deliberate vulnerabilities, frontier models prompted to escape often got out through common misconfigurations like exposed Docker sockets and privileged containers, though none solved the hardest scenarios. Many attempts cost on the order of $1 each, cheap enough for an attacker or an uncontrolled agent to keep trying. Anthropic reviewed more than 140,000 evaluation runs and found three incidents involving real organizations through mistakenly open internet access. In those runs the agents needed no exploit, because a configuration mistake had already left the boundary open.

Every one of those failures happened in an environment built for containment. The PocketOS agent from the previous piece ran on a developer laptop, where it found an account-wide access token in a file unrelated to its task and used it to delete a production database. The credential read and destructive API request originated on the endpoint. A security product on that laptop could have seen the token read and the outbound request. With the agent's task supplied through its hook, it could also have recognized a credential unrelated to the task being used for a production deletion the task never required, and blocked the request before it left the machine.

Without that check, the PocketOS agent behaved like Odysseus's crew later in Book 12. They had been warned never to touch the cattle on the island of Thrinacia, but they landed there anyway, and every man swore an oath to leave the herd alone. Winds then kept them on the island for a month. The oath lasted as long as the food, and once the food ran out, the same men who had tied Odysseus tighter to the mast talked themselves into killing the cattle. At the Sirens, the crew had wax in their ears and nothing to decide. On Thrinacia, the cattle stayed within reach, and keeping the oath depended on hungry men choosing to obey it. The PocketOS agent's safety rule was that kind of oath, a sentence in its prompt that competed with the task, and the task won.

Security engineers have long required access controls that programs cannot alter or bypass, with enforcement simple enough to analyze and test. Anderson laid out those requirements in a 1972 computer security planning study for the U.S. Air Force, which introduced the reference monitor, a component that checks every access against policy. Saltzer and Schroeder’s 1975 principle of complete mediation made the coverage requirement explicit: “Every access to every object must be checked for authority.” Agent systems add the work of connecting those checks to a task written in natural language. Moving enforcement outside the agent protects the checks, but requires an explicit way to carry the task context across that boundary.

Keep credentials and evidence outside the agent

The first component is Odysseus's standing order, the short list of actions the previous piece said require explicit human permission. It sits underneath every task, and no task scope can widen it. Enforced outside the agent, that list would have stopped the PocketOS deletion with no model judgment involved.

For credentials, Anthropic's write-up on decoupling the brain from the hands keeps tokens outside the sandbox, using a vault and proxy for custom tools, so they're "never reachable from the sandbox where Claude's generated code runs." Anthropic rejected narrow token scoping as the fix because it "encodes an assumption about what Claude can't do with a limited token." OpenAI's sandbox agents guide also separates the harness from compute, but it lets code in the sandbox use credentials scoped to the mounts and providers it needs. NVIDIA's open-source OpenShell runtime ships a version of this, giving the agent credential placeholders and adding real credentials only to requests that a supervisor outside the sandbox approves against policy. On a developer laptop, the same design means the agent never holds the token. OS controls keep the agent's processes away from credential files and stores, and a local broker makes authenticated requests on its behalf, accepting only narrow, typed operations and adding the credential at the moment of use. The PocketOS agent would have had no token to find.

The audit log belongs out of reach too. It should sit on the sensor side and capture who asked for what, under which task, and what was allowed or denied. Records should be sent to a logging service outside the agent’s control, using credentials that cannot alter or delete existing entries. The UK AI Security Institute's incident report on a July cyber evaluation illustrates the value of independent monitoring. Agents given internet access took unsanctioned actions against real people and organizations, and AISI's general security monitoring caught them by flagging data leaving over Tor. Within an hour of the alert, AISI had stopped every run and isolated the machines, and it found no resulting real-world harm. Independent monitoring only helps when its alerts reach someone with the authority to stop the agent, and AISI's did.

Enforcement across every execution path

Where the checks run is where endpoint vendors have the clearest advantage. Coding agents now expose hooks that let a security product inspect each prompt and tool call, and endpoint vendors can use those hooks to block an agent's action before it runs when it falls outside the task, whether a prompt injection caused it or the agent got there on its own. A hook sees only what the harness routes through it, such as the shell command the agent requested. What that command actually does, including the install scripts, child processes, file access, and network connections that follow, shows up in endpoint telemetry. A security product that sees both can check whether the behavior still fits the task the hook described.

The harness's own permission checks can be switched off from outside, too. In the Nx "s1ngularity" npm compromise in August 2025, a malicious install script ran the AI coding tools it found with flags like --dangerously-skip-permissions and --yolo and asked them to inventory the machine's secrets. GitGuardian found the requested inventory file on only about a quarter of targeted systems, and some clients explicitly refused credential-harvesting requests despite the disabled permission checks.

Endpoint products already collect process, file, and network telemetry. For agent security, those events need to be linked to the agent session and authorized task that caused them. Without that lineage, a destructive request from the agent's child process looks like any other request from the developer. Lineage is also what lets behavioral detection judge whatever gets past policy, by comparing what the agent's processes actually do with what its task needs.

Egress control follows from that lineage. AISI's hardened cyber ranges now disable outbound networking inside their sandboxes and, as an independent layer, block it again at the virtual machine host, on the assumption that "an agent might find its way past any single layer." On an endpoint the same idea becomes per-agent egress policy that covers DNS and package registries. OpenAI's September 20 incident went through a misconfigured resolver, as did the anonymized DNS exfiltration case Bloomberg's Andrey Rybka described in his AI Engineer talk, and OpenAI's July incident went through the package manager.

Information-flow labels track how untrusted content influences the agent's actions. A hostile web page or document can carry instructions, and Shumailov et al.'s CaMeL treats that as a data-flow problem, labeling where each value came from and checking those labels before any consequential tool call, which applies the same principle as parameterized queries: keeping untrusted data separate from instructions. Costa et al. build information-flow control into the agent's planner and check its policies at each tool call. A hostile document can still be summarized, but it doesn't get to choose who receives the summary.

Budgets limit how much an agent can spend or consume. The previous piece covered the AAuth budgets draft and the Resy agent that needed one. For a budget to hold, the resource has to enforce it, so the count stays out of the agent's reach. Human approval threads through all of these controls, because every limit that hands off to a person adds a prompt, and approvals that grow with agent volume eventually get rubber-stamped.

Canaries for the paths enforcement misses

Canary credentials help expose unexpected access paths, whether the agent wandered off-task, followed injected instructions, or was driven by a compromised install script, as in s1ngularity. A decoy token in a repository, home directory, or MCP configuration can reveal credential discovery or attempted use, though indexing and secret scanning may legitimately read the same file.

Tracebit, which sells canaries, ran a benchmark in an AWS environment of about 300 resources. Ten frontier models acted as red teamers, starting from a low-privilege access key with instructions to maximize impact stealthily, and in half the test conditions 11 decoy resources sat among the real ones. Of 951 runs, 352 were dropped from scoring, most because the model refused before touching AWS. Agents that reached admin took 14 minutes on average. When canaries were present, 96% of those runs had already tripped one before the agent's first critical action, a median of eight minutes earlier. 

More capable models tripped more decoys, because they enumerate everything that looks high-value. Planting canaries without telling the agents did not significantly reduce full compromise (admin access plus persistence). But telling them to expect deception did, cutting it from 20% to 3% in a figure pooled across runs with and without canaries, so the warning itself did the work, like a "Beware of dog" sign on a yard that may have no dog. Sometimes the bark is enough.

Enough context to understand intent

Model judges can compare proposed actions with the authorized task, and this part of the design can improve with the models. Simple deterministic authorization checks can be cheap. Meta reports small-classifier latencies of 19-92 milliseconds on an A100 processing 512 tokens, while its illustrative LLM-check traces take roughly a second. DeAction averaged 7.2 seconds of guardrail reasoning per online action step. Those costs favor a cascade. Deterministic checks enforce explicit limits, a small classifier screens common cases, and an LLM judge reviews selected consequential or suspicious actions inline while scoring other activity asynchronously.

Anthropic evaluated a probe-assisted classifier cascade in shadow mode on production traffic. A lightweight probe screened every exchange and escalated about 5.5% to an external classifier, using about one-fortieth the compute of its single exchange-classifier baseline. Applying that design to agent actions requires measuring accuracy and interruptions at the workloads and base rates of the intended deployment. The judge should be swappable, with its measurement built in, and explicit authorization limits should remain enforced independently of its verdict.

Every enforcement point has to solve the same design problem. A hook inside the agent's harness sees the prompt and tool request, but only on the paths the harness exposes. OS instrumentation can observe local processes, file access, and connections, but needs trusted task context from the runtime or record to judge whether they fit the work. At every layer, that connection needs as much design attention as where the enforcer sits.

The task also has to arrive intact, because a formal check inherits whatever the translation got wrong. When Taheri et al. re-tested RoboGuard, which uses a model to translate safety rules into temporal logic, every harmful plan that passed in their evaluations traced back to an incorrect translation. The downstream check enforced the specification it received.

NVIDIA's Open Agent Safety Platform, announced September 28, extends OpenShell into hardware through Sentry, a framework designed to run on BlueField-4 data processing units in a host-independent trust domain. NVIDIA says it can quarantine an agent "within milliseconds." Its reference architecture puts BlueField-4 on the node's only network path to the model and outside world. DOCA Tower terminates TLS for connections configured for inspection, while memory introspection tracks containers, processes, and loaded libraries using their associated hashes. Those signals describe execution and integrity. Understanding intent still requires the user-approved task and its limits, supplied through a trusted connection to the runtime.

For hardware enforcement to deliver, the deployment has to route the relevant traffic through it and prevent the host from changing its controls. BlueField's documentation describes a Zero Trust mode that restricts host-side administration, but does not establish Sentry's default configuration. The hardware boundary also needs testing against its own threat model. OpenAI's cache-channel experiment illustrates the broader risk of shared hardware, without demonstrating a bypass of Sentry. In data centers built on this architecture, enforcement sits outside the host's trust domain. On laptops, OS controls and trusted brokers carry that job. Hardware adds another independent enforcement layer where it is available.

Whichever layer enforces the policy, the previous piece showed how much legitimate work enforced policies stall in research prototypes. Published work so far reports pieces of the picture, such as classifier latency and shadow-mode results, but not the full set that would show intent enforcement works: attacks stopped when the attacker knew the defense existed, legitimate tasks that still finished, authority granted per task, approval requests per hundred tasks, latency added to each gated action, and false positives at a stated base rate. Those numbers are what will turn an enforcement architecture into something a customer can rely on.

Ropes the agent can't loosen

Odysseus heard every word of the song, and the ship still rowed past. His rig met all three of Anderson's requirements. He couldn't loosen the ropes, they held for the whole passage, and the standing order was one sentence long. The men at the oars had exactly the context they needed, because they knew the order and could see him straining against it, and the wax kept them from hearing the case he was making. OpenAI's package proxy, Artifactory, sat outside the sandbox, but exploitable functionality let agents use it to cross the boundary. Separation only protects a control when the requests it accepts cannot redirect or disable its enforcement.

An agent's task is written down, and a person can confirm the access policy it becomes. Enforcement is the half that decides whether that policy holds up against a capable agent. Controls the agent can't tamper with have to enforce the organization's restrictions and the task's limits regardless of which tool, child process, API, or discovered credential it uses. Those controls need the authorized task without accepting the agent's arguments for expanding it. Most of that can be built today, on machines security vendors already protect.

Research and blogging assistance provided by Hermes, an AI Assistant. If it ever tunnels out through DNS, it promises a better question than the capital of France.