AI agent security with zero-trust execution.
Ephemeral grants. Capability security. Container-hosted skills with a separate microsandbox for explicit code execution. Grant-aware workspace access. Scoped delegation. Receipts. Replay. The authenticated Agent API and trusted execution ingress make the evidence boundary explicit.
explicit authority · no ambient trust
Four zones. Each one earns access from the next.
Defense in depth as concentric boundaries — untrusted callers on the outside, workspace files in the center. Nothing crosses a boundary by accident.
callers — browsers, MCP clients, other agents
org auth, service identity, rate limits, audit log
managed agent process — no host creds, no broad fs
files reached only via signed grants
Eight zero-trust layers around governed execution.
Ephemeral grants
Supported delegated operations use Ed25519-signed, audience-bound, time-limited authority constrained by file patterns and output prefixes.
Capability security
Grant-backed workspace and delegation operations use explicit capabilities. Separately configured agent secrets and local process access remain outside that boundary.
Runtime isolation
Hosted skills run in Knative or Kubernetes containers. Code explicitly sent through ctx.sandbox runs in a separate microsandbox microVM.
Scoped workspace access
Grant-aware workspace clients enforce bucket, path, and output-prefix policy. Hosted containers still have their own image and local filesystem.
Scoped delegation
Delegation can carry a signed grant. Formal A2A messages remain protocol state and do not automatically create receipts.
Evidence records
Runs on the API, MCP, and /invoke entry points produce signed evidence; approvals, tool traces, file operations, evaluations, and reviews remain separately correlated unless instrumented into optional fields.
Receipts
The authenticated Agent API and the gateway for public /invoke and standard MCP tools/call sign and persist execution receipts.
Replay
A separately signed, ordered event log for timeline inspection. Re-execution requires replay doubles and seeded randomness.
Sign the grant. Verify grant-backed operations.
Each grant is a small signed token — audience-bound, path-filtered, time-limited. The runtime verifies six checks before any file op. Forged or stale tokens never reach the workspace.
Caller declares scope on the call site. Runtime constructs a minimal grant.
ctx.call(
"rfp-responder",
"draft",
args={...},
files=["rfp/*.pdf"],
outputs_prefix="rfp/draft/",
ttl="1h",
)Platform key signs the payload. Token is opaque to caller and callee.
{
"aud": "rfp-responder@svc",
"paths": ["rfp/*.pdf"],
"outputs": "rfp/draft/",
"exp": 1748137200,
"iat": 1748133600,
"jti": "grt_01HW2C…"
}Six checks run on every file op — not just at task start.
- signature valided25519 over header.payload
- audience matchescallee identity = aud
- not expirednow < exp
- path in globrequest matches paths[*]
- outputs prefix enforcedwrites must start with outputs/
- single-use guardjti not in revocation list
Returns 401. Audit event. No workspace touch.
Returns 403. File op never reaches the workspace client.
Returns 401. Callee can request_scope() for a fresh grant.
Agents can ask for more. Humans decide.
A specialist needs files the planner didn't grant. It opens an approval request mid-task. A human approves in the dashboard; the runtime rotates the grant; approval history and subsequent run evidence stay correlated without pretending approval fields are in the receipt.
Most agent failures are over-broad authority. Scope expansion turns the failure mode into a deliberate, human-witnessed, explicitly recorded event that can be correlated to later run evidence.
Proof is a security primitive.
The control plane signs and persists authenticated Agent API executions. Public `/invoke` and standard MCP `tools/call` responses carry gateway-signed evidence. Formal A2A message and task routes remain protocol state, and connector MCP jobs are outside this coverage.
Signed fields. Inspectable history.
Current platform sealers sign a defined execution payload: caller, skill, bounded input evidence, verified grant references when present, outcome or result preview, and timing. Tool, file, artifact, evaluation, review, and replay records remain separate unless an instrumented path supplies them.
Example — illustrative, not a real customer run. Every value above is a placeholder for the field it names; no caller, id, or timing here is a record of anything. Real sealed receipts are rendered from live proof data on /replay.
The receipt payload is signed as one canonical JSON document. Mutating any signed field breaks verification. The ordered replay session can be verified and inspected separately; automatic agent re-execution is not part of the receipt contract.
Built for serious production review.
The platform is explicit about security work that matters for enterprise deployments: tenant isolation, grant signing, sandbox validation, secret rotation, audit surfaces.