The Agent Trust Boundary
Identity, permissions, and blast radius for software that acts on its own
An agent is a new principal in your system rather than a feature of your application, so its security comes from where you draw its boundary and never from prompt hygiene.
Assume the injection succeeds. That single assumption reorganises the whole problem: security stops being a matter of instruction wording and becomes a question of identity, authority and containment. This book draws the boundary, covering who the agent is, what it may call, where its code runs, what it may reach and what it may remember, and places enforcement outside the model, at the gateway, the tool or the destination system. It ends with the evidence an auditor asks for, because from 2 August 2026 some teams have to produce it.
What it makes operable
-
01
Map the trust boundaries of an agentic system and name every principal inside it
-
02
Give each production agent one identity and enforce its authority outside the model
-
03
Choose an execution sandbox that matches code nobody has reviewed
-
04
Produce the logging, oversight and documentation evidence an auditor asks for
Contents
12 of 12 published
Every chapter is free to read in the browser, cites its own sources, and stands on its own if you came for one decision rather than the whole argument.
- 01 The Agent Is a Principal, Not a Feature What changes the moment software starts acting under an identity of its own. 10 min
- 02 Mapping Trust Boundaries in an Agentic System Drawing the lines between model, tools, data sources, other agents and people. 10 min
- 03 Indirect Prompt Injection as the Default Condition Designing on the assumption that the injection lands. 11 min
- 04 Least Privilege at the Tool Layer Capability reduction per data source, enforced by the tool rather than the prompt. 11 min
- 05 One Identity per Agent Workload identity, short-lived credentials, and an explicit authority record. 11 min
- 06 Authorization Enforced Outside the Model Moving the decision to the gateway or the destination system. 12 min
- 07 Running Code Nobody Reviewed Matching isolation, from hardened container to user-space kernel to microVM, to the threat model. 11 min
- 08 Egress Control and Data Exfiltration Deterministic network blocks as the last defence that still works. 12 min
- 09 Memory and Context Poisoning Quarantining what an agent is allowed to believe about its own past. 12 min
- 10 Inter-Agent Communication and Cascading Failure Signed identity across a boundary, and containment when one agent is wrong. 12 min
- 11 Supply Chain: Models, Prompts, Servers, Skills Inventory and provenance for everything an agent loads at runtime. 12 min
- 12 Evidence for Auditors: Logging, Oversight, Documentation Tamper-evident logs, a stop control that works, and docs generated from the repo. 13 min
Evidence · 5 sources
Third-party sources behind the book's premise. Every figure in them belongs to the party that published it and is attributed to them in the text.
