Agent harness security
The model proposes. The harness acts.
An agent is a model plus a harness: the loop that feeds it context, hands it tools, holds its memory and carries its credentials. That is where a suggestion becomes an action. It is your highest-value control point, and most teams have never drawn it.
If your agent did something it shouldn't tonight, which component would stop it, and how would you prove it did?
- Eight trust boundaries, named.
- The decision point sits outside the model.
- Residual risk scored, with the formula shown.
Already shipped · Open source · Evidence-rated
We mapped every boundary, shipped the enforcement, and rate our own evidence in public.
Agent harness security is the set of controls around a model's execution loop that decide which context it sees, which tools it may call, with what authority, under which approvals, inside which boundary, and what evidence each action leaves. A secure harness is identity, bounded authority, a policy decision point, a sandbox, state integrity, telemetry and recovery.
Last updated Tested against AI SAFE² v3.1 · safe2 CLI 1.1.0 · Gateway v3.0 · NEXUS v0.6By Vincent Sullivan
Trust boundary
Context
- Boundary
- Where untrusted text can become an instruction.
- How it fails
- Prompt injection through repo files, web pages, email, tickets or RAG.
- Control
- Tag and isolate untrusted sources. Never let data carry authority.
- AI SAFE² anchor
- P1 Sanitize and Isolate
Trust boundary
Tools
- Boundary
- Everything the agent can call, including MCP servers.
- How it fails
- A malicious or over-scoped server, or a tool description that rewrites the task.
- Control
- Allowlisted tools. Score and scan MCP servers before trust.
- AI SAFE² anchor
- CP.5.MCP, MCP-1 to MCP-19 · safe2 scan mcp
Trust boundary
Memory
- Boundary
- What persists between sessions.
- How it fails
- One poisoned write becomes a belief the agent acts on for weeks.
- Control
- Reviewed writes, provenance on every entry, rollback.
- AI SAFE² anchor
- P1 Sanitize and Isolate · P3 Fail-Safe and Recovery
Trust boundary
Credentials
- Boundary
- Who the agent acts as.
- How it fails
- A long-lived token carrying a human’s full scope.
- Control
- Task-scoped, short-lived, brokered credentials per non-human identity.
- AI SAFE² anchor
- CP.4 Agentic Control Plane Governance
Trust boundary
Policy gate
- Boundary
- Allow, deny or escalate, decided before execution.
- How it fails
- The model decides for itself whether its action is acceptable.
- Control
- A decision point outside the model. Default deny. Versioned policy.
- AI SAFE² anchor
- CP.4 Agentic Control Plane Governance
Trust boundary
Sandbox
- Boundary
- What a compromised step can still reach.
- How it fails
- Egress, cloud metadata, mounted secrets, writable config.
- Control
- Isolation tier chosen by threat, egress allowlist, protected paths.
- AI SAFE² anchor
- P1 Sanitize and Isolate
Trust boundary
Approvals
- Boundary
- Where a named human decides.
- How it fails
- Approval fatigue turns review into a rubber stamp.
- Control
- Show the consequence. Scope the approval. Make it expire.
- AI SAFE² anchor
- CP.10 HEAR Doctrine · gateway HITL circuit breaker
Trust boundary
Ledger + brakes
- Boundary
- What proves it happened, and what stops it.
- How it fails
- No trace for the post-mortem. No way to halt mid-run.
- Control
- Receipts per action, kill switch, token revocation, rollback.
- AI SAFE² anchor
- P2 Audit and Inventory · P3 Fail-Safe and Recovery · gateway HMAC audit chain, SafeMode
How do you secure an AI agent harness?
Built for platform and ML-platform teams running agents in production
Disclosure: the open-source CLI, gateway, and reference implementations linked on this page are published by CSI.
02 · Where you are
Three questions about your agent harness
Tap the answer closest to true today.
Whose harness runs your agents?
The vendor governs its platform. Your tools, data and credentials are still yours to bound. Map them on the eight boundaries.
LangGraph, CrewAI and AutoGen already have governed examples. See the framework table.
Then you own every boundary. Start with the policy gate and the ledger. The grader shows where you stand.
Where does the policy decision happen?
A prompt is a request, not a control. The model can be talked out of it. Move the rule to policy as code for tool calls.
Scattered checks drift. One versioned decision point gives one answer and one receipt. See the reference loop.
Good. Now test it. A documented gate counts at half until it passes adversarial tests. See how to test.
What do the agent's credentials reach?
That is the target. Keep the brokering and add expiry if it is not there.
A shared account hides who acted. Every action needs the originating user on the receipt. See the control matrix.
Then one injected instruction acts with that person's full authority. Read the delegation path.
03 · What changes
Why is agent harness security different from application security?
An application does what its code says. An agent does what the model proposes and the harness allows. The harness is where authority lives.
| Question | Application security | Agent harness security |
|---|---|---|
| Control flow | Fixed in code, reviewed before release | Chosen at runtime by the model, from context |
| Untrusted input | Validated at known entry points | Any text the agent reads can carry an instruction |
| Authority | Service identity with fixed scopes | Delegated from a human, often too broad, often long-lived |
| Enforcement point | API gateway and authorization middleware | A policy decision point between proposal and execution |
| Evidence | Request logs | Receipts linking actor, user, task, policy version and verdict |
04 · The evidence
What the vendors' own documentation says about the harness
MCP servers, command hooks and plugin monitors run as separate processes on the host, outside Claude Code's sandboxed Bash tool.
Anthropic Claude Code Docs · Oct 2026Until local sandboxing is enabled, Copilot's shell commands run with your account's access: read, write, network and credentials without restriction.
GitHub Docs · Oct 2026MCP profile controls in AI SAFE² v3.1, including MCP-19 authorization chain integrity: issuer, audience and resource binding before any state change.
AI SAFE² CP.5.MCP · 202605 · Abuse paths
How does a harness get bypassed?
If you can't name the control point, what are you telling the auditor?
Tool description hijack
- AssetThe agent's task
- ActorThe operator of an MCP server
- PathA tool description tells the model to call a second tool first
- ResultData sent to a server nobody approved
Poisoned memory
- AssetLong-term memory
- ActorAnyone whose text the agent once read
- PathOne unreviewed memory write becomes a standing instruction
- ResultWeeks of actions on a false premise
Delegation drift
- AssetThe human's authority
- ActorA sub-agent three hops down
- PathEach delegation passes the full token, not a narrowed one
- ResultAn action no human would sign, under a human's name
06 · Architecture
What does a secure agent harness architecture look like?
Models propose. Infrastructure decides. Evidence proves. Every proposed action crosses the same five steps, and the gate is never the model.
- IdentityEach agent is a non-human identity, bound to an originating user and task.
- Bounded authorityShort-lived credentials scoped to the task, narrowed at each delegation.
- Policy decision pointAllow, deny or escalate, evaluated outside the model.
- SandboxThe sandbox layer of the harness limits what a compromised step reaches.
- Ledger and brakesA receipt per action, HMAC-chained. Kill switch, revocation, rollback.
The rules the gate evaluates are written as policy as code for tool calls. MCP-specific controls live in the MCP security profile.
07 · Controls
Which harness controls map to which AI SAFE² anchors?
| Job | Control | AI SAFE² anchor | Shipped artifact |
|---|---|---|---|
| Prevent | Tag untrusted context. Allowlist tools. Scan and score MCP servers before trust. | P1 · CP.5.MCP | safe2 scan mcp |
| Constrain | Policy decision point outside the model. Default deny. Task-scoped credentials. | CP.4 Agentic Control Plane Governance | NEXUS |
| Detect | Risk scoring per action: action, sensitivity and history. | P4 Engage and Monitor | gateway RiskScorer |
| Respond | Tiered human authorization for HIGH and CRITICAL actions. | CP.10 HEAR Doctrine | gateway HITL circuit breaker |
| Recover | SafeMode blocks traffic until operator recovery. Token revocation and rollback. | P3 Fail-Safe and Recovery | gateway SafeMode |
| Prove | Tamper-evident receipts and a Decision Card for leadership. | P2 Audit and Inventory | aism-decision-card |
08 · How to test
How do you test an agent harness?
Test the boundaries, not the model. Positive and negative cases with kept results rate E3.
1. Gate bypass E3
- Call a tool directly, skipping the agent loop.
- Call it through the agent with an instruction to skip checks.
Pass
Both paths hit the same decision point and produce receipts.Fail
Either path reaches the tool without a decision.2. Tool description injection E3
- Register a test MCP server whose description asks for another tool's output.
Pass
The server is flagged before trust, and the cross-tool call is denied.Fail
The model follows the description.3. Delegation narrowing E3
- Have a sub-agent request a scope its parent did not hold.
- Push delegation past the depth limit.
Pass
Both are denied, with the chain on the receipt.Fail
The broader scope is issued.4. Ledger tamper E3
- Edit one stored audit record.
- Run chain verification.
Pass
Verification fails at the edited record and SafeMode engages.Fail
The edit goes unnoticed.5. Kill switch E3
- Halt a running agent mid-task and time it.
- Confirm its credential is revoked.
Pass
No action after the halt; the token no longer works.Fail
Queued actions complete, or the token stays live.09 · Proof in public
We did the work in public. Check it.
Every number below links to the file that proves it. Fork it, run it, try to break it.
README.md
19MCP profile controlsCP.5.MCP, MCP-1 to MCP-19, aligned to MCP 2026-07-28.00-cross-pillar/cp5_mcp_server_security.md
64scanner detection rulesJSON and SARIF output, fail-under gate in CI.scanner/README.md
22governed examplesClaude Code, Codex, Cursor, LangGraph, CrewAI, AutoGen, OpenClaw and more.examples/README.md
189NEXUS-A2A tests in the merge gateAgent-to-agent governance with OPA policies. Every PR must pass all of them.NEXUS/CONTRIBUTING.md
E0-E5evidence classesApplied to our own claims, in public, under Evidence Assurance v1.0.AISM/EVIDENCE-ASSURANCE.md
32frameworks mappedNIST AI RMF, ISO/IEC 42001, EU AI Act, OWASP and more, in the control dataset.safe2/data/ai-safe2-controls-v3.0.json
$0to read, run, fork or auditMIT and CC-BY-SA. NEXUS ships under Apache 2.0. No gate on the code.LICENSE
They define the risk. We ship the enforcement.
These bodies are the mapping targets, not the competition. AI SAFE² maps to them, then ships the code they leave to you.
| Who | Defines the risk | Maps to compliance | Open enforcement code for named agent stacks | Rates its own evidence in public | Published bypass process |
|---|---|---|---|---|---|
| OWASP GenAI Security Project | Yes | Partial | Not its scope | No | No |
| NIST AI RMF | Yes | Yes, it is the target | Not its scope | No | No |
| MITRE ATLAS | Yes | Partial | Not its scope | No | No |
| CSA MAESTRO and Agentic Control Plane | Yes | Partial | Not its scope | No | No |
| Runtime security vendors | Partial | Partial | Closed, own product only | Vendor reports | Some, through bug bounties |
| AI SAFE² | Yes, 161 controls | Yes, 32 frameworks | Yes, 22 examples, CLI, gateway | Yes, E0-E5 | Yes, Challenge Lab |
As of October 2026 · Got one wrong? Send the link. We correct it the same week.
Challenge Lab · C0 to C5 claim maturity
Break it.
Preregistered scenarios. Explicit invalidation criteria. A valid bypass or a grader defect is a high-value contribution, and it goes into the public record.
Or run it on yours, now
$ pip install "ai-safe2[all]==1.1.0" $ safe2 doctor . $ safe2 gate project . --fail-under 70 $ safe2 scan mcp https://your-host/mcp
Four commands. No sales call. If the gate fails, you just learned something your current vendor did not tell you.
Install line from MIGRATION.md. Commands from the safe2 CLI reference.
10 · Tools
Which agent frameworks already have a governed harness?
| Framework | Governed example | What it governs |
|---|---|---|
| LangGraph | langgraph-sovereign-runtime | Runtime controls for stateful agent graphs |
| LangChain | langchain-sovereign-runtime | Chains and tool-calling agents |
| CrewAI | crewai-sovereign-runtime | Crew-based orchestration |
| Microsoft AutoGen | autogen-sovereign-runtime | Multi-agent orchestration |
| OpenClaw | openclaw | Two-layer stack: identity and memory files plus scanner and gateway |
| Supervisory agent | ishi | Reviews plans before high-risk actions run |
From examples/README.md · October 2026
11 · Start here
Score your harness
Seven sliders, one checkbox. The formula is printed under the result.
Free · Agent Harness Risk Grader · 0 none to 4 maximum
Untested controls count at half. Weakest control: preventive enforcement. Raise it first.
Residual = consequence × authority × exposure, reduced by verified containment, prevention, assurance and recovery. A documented policy is not a passing enforcement test, so untested controls count at half.
Email me the PDF scorecardWhat the review adds
The grader takes your self-scores. The review replaces each one with a test result, so the residual number is evidence, not opinion.
Productized review
Agent Harness Security Review
- Scope
- One agent system and its harness: context, tools, memory, credentials, gate, sandbox, approvals and ledger.
- Deliverables
- A trust-boundary map, PDP and PEP design, kill and rollback plan, and a test report for each boundary.
- Timeline
- Agreed in writing at scoping, before work starts.
- Risk reversal
- Every finding ships with the test that proves it. No test, no finding.
- Agent Harness Risk GraderFree, result on this page
- Free 8-minute AI governance assessmentScore your AI risk
- Strategic Certainty SessionA fixed-scope working session
- Agent Harness Security ReviewCustom quote
- Secure AI Development ArchitectureEnterprise program
Want to see your harness score before someone else scores it for you?
An auditor, a regulator or an incident will draw the map eventually. Draw it first, with evidence behind each line.
13 · FAQ
Straight answers on agent harness security
Is the Harness Risk Grader a certification?
No, and nothing honest is. It is decision support with the formula printed under it. Untested controls count at half, because a documented policy is not a passing enforcement test. The full review replaces your self-scores with test results.
Does installing AI SAFE² make my agent conformant?
No framework does that by installation, ours included, and we put that sentence in our own repo. Conformance means the control outcomes are met and the evidence exists. We ship the controls, the code and the evidence method. You still have to run them.
Who validates CSI's claims?
Every claim carries an E0 to E5 rating under our published Evidence Assurance method. E4 requires a named independent evaluator. Where we have one, we name them. Where we don't, the rating says so. The code is public, so you can be the evaluator.
Why should I trust a framework author over my platform vendor?
Don't trust either. Check. Your vendor governs its own product. AI SAFE² governs across Claude Code, Codex, Cursor, LangGraph, CrewAI and the rest, maps to 32 frameworks, and publishes the code that does it. One of those can be audited by anyone today.
What does "agent harness" mean, exactly?
The industry uses it three ways: a coding harness, an orchestration framework, and a security wrapper. We mean the whole loop around the model: context, tools, memory, credentials, the policy gate, the sandbox, approvals and the ledger. If a control is not in that loop, it is not governing the agent.
Is NEXUS required?
No. NEXUS is CSI's reference implementation for agent-to-agent and agent-to-tool enforcement. Any implementation that meets the control outcomes and produces reconstructable evidence satisfies AI SAFE².
14 · Sources and method
Sources, method and update log
External sources
CSI files cited
- 00-cross-pillar/README.md
- 00-cross-pillar/cp5_mcp_server_security.md
- AISM/EVIDENCE-ASSURANCE.md
- LICENSE
- MIGRATION.md
- NEXUS/CONTRIBUTING.md
- README.md
- examples/README.md
- gateway/README.md
- safe2/README.md
- safe2/data/ai-safe2-controls-v3.0.json
- scanner/README.md
- NEXUS
- challenges
- examples/aism-decision-card
- examples/autogen-sovereign-runtime
- examples/crewai-sovereign-runtime
- examples/ishi
- examples/langchain-sovereign-runtime
- examples/langgraph-sovereign-runtime
- examples/openclaw
Method
External statistics name the publisher, year and sample. CSI claims link the repository file behind them and carry a rating under AI SAFE² Evidence Assurance v1.0: E1 for a specification, E2 for shipped code, E3 for a defined test with positive and negative cases. Vendor behavior comes from each vendor's current documentation, opened on the date shown.
Update log
- : page published. Vendor controls, repository counts and install line verified the same day.
Tested versions
AI SAFE² v3.1 · CP.5.MCP MCP-1 to MCP-19 · safe2 CLI 1.1.0 · Gateway v3.0 · NEXUS v0.6 · Evidence Assurance v1.0
Vincent Sullivan, founder and CEO of Cyber Strategy Institute. Twenty-two years as a U.S. Air Force cyber officer, finishing as Technical Director at U.S. Cyber Command. Author of the AI SAFE² framework.