Skip to content

Instantly share code, notes, and snippets.

@bureado

bureado/agent-rsp-references.md

Last active February 2, 2026 16:30
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save bureado/71dfb7380e8a1cd7294c2f8b8136d085 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save bureado/71dfb7380e8a1cd7294c2f8b8136d085 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
agent-rsp-references.md

This is a collection of resources supporting the idea that provable runtime security guarantees for agents can be intrinsically bound to agent identity, perhaps as part of a broader representation of "intent", or in a tiered trust model. TEEs, hypervisor-enforced isolation, hardware roots of trust and several Linux security primitives are instrumental to get there. We curate some of the most promising references to date including applied technologies in agent frameworks, research and risk/mitigation-focused literature on this topic.

Agent runtime security

Risk/mitigation literature that discusses the importance of agent runtime security includes:

Several of them recommend cryptographically protecting the integrity of tools, tool descriptions, models, data sources, and tool provenance. They advise sandboxing, increasing security observability, or using server-constrained or client-bound tokens.

An observation from Meta: agents can't simultaneously process arbitrary inputs, communicate externally, and access private data.

Note: This list focuses on agent security, but runtime security is relevant for training too, as illustrated in Atlas: A Framework for ML Lifecycle Provenance & Transparency (code) and ongoing OpenSSF discussions around GPU-based model integrity and model lifecycle provenance. Also see ws1-supply-chain/signing-ml-artifacts.md at main - cosai-oasis/ws1-supply-chain.

An incomplete survey of security technology applications

Here's a few examples of applied compositions of Linux security technologies to the problem of agent runtime security:

New LF initiative worth tracking: Open Robust Compartmentalization Alliance (ORCA)!)

Tool discovery, sandboxing and isolation, tracing and observability, policy, redaction, and threat detection are all activities expected to happen at the boundary of agents. Examples include:

Comprehensive instrumentation is also part of agent runtime security. eBPF has a credible track record in application observability, and this year has seen some research in the form of AgentSight or [2509.07764] AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents (code).

Proofs and workload identity

Along with [2511.03434] Inter-Agent Trust Models and the Nanda Unified Architecture (2025), the CoSAI document is more explicit than others discussing the role Trusted Execution Environments (TEEs), secure key usage, and remote attestation play in agent security. But should those proofs be part of the agent identity? There's no shortage of activity happening in this space:

Forums and working groups

Further reading

Linux security technologies

Applied secret injection techniques for agentic scenarios

  • Simple techniques like prxlocal seek to separate the secret from the agent execution
  • A more powerful approach, seen here in agent-creds, combines secret injection with caveated (restricted) tokens a-la-Macaroon
  • yolo-cage incorporates several interesting ideas including live secret scanning, a git dispatcher (for enforcement of what Shai calls "cellular development"), and container isolation
  • nono implements a secrets management layer that uses the OS' secure stores
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment