Vishal Rajpurohit
Bring the software problem
All books
Jacket for The Agent Trust Boundary — Identity, permissions, and blast radius for software that acts on its own

AI Security & Governance

The Agent Trust Boundary

Identity, permissions, and blast radius for software that acts on its own

Start reading Contents

An agent is a new principal in your system rather than a feature of your application, so its security comes from where you draw its boundary and never from prompt hygiene.

Assume the injection succeeds. That single assumption reorganises the whole problem: security stops being a matter of instruction wording and becomes a question of identity, authority and containment. This book draws the boundary, covering who the agent is, what it may call, where its code runs, what it may reach and what it may remember, and places enforcement outside the model, at the gateway, the tool or the destination system. It ends with the evidence an auditor asks for, because from 2 August 2026 some teams have to produce it.

What it makes operable

  1. 01Map the trust boundaries of an agentic system and name every principal inside it
  2. 02Give each production agent one identity and enforce its authority outside the model
  3. 03Choose an execution sandbox that matches code nobody has reviewed
  4. 04Produce the logging, oversight and documentation evidence an auditor asks for

Contents

12 of 12 published
  1. 01The Agent Is a Principal, Not a FeatureWhat changes the moment software starts acting under an identity of its own.11 min
  2. 02Mapping Trust Boundaries in an Agentic SystemDrawing the lines between model, tools, data sources, other agents and people.11 min
  3. 03Indirect Prompt Injection as the Default ConditionDesigning on the assumption that the injection lands.11 min
  4. 04Least Privilege at the Tool LayerCapability reduction per data source, enforced by the tool rather than the prompt.11 min
  5. 05One Identity per AgentWorkload identity, short-lived credentials, and an explicit authority record.11 min
  6. 06Authorization Enforced Outside the ModelMoving the decision to the gateway or the destination system.12 min
  7. 07Running Code Nobody ReviewedMatching isolation, from hardened container to user-space kernel to microVM, to the threat model.12 min
  8. 08Egress Control and Data ExfiltrationDeterministic network blocks as the last defence that still works.13 min
  9. 09Memory and Context PoisoningQuarantining what an agent is allowed to believe about its own past.12 min
  10. 10Inter-Agent Communication and Cascading FailureSigned identity across a boundary, and containment when one agent is wrong.12 min
  11. 11Supply Chain: Models, Prompts, Servers, SkillsInventory and provenance for everything an agent loads at runtime.13 min
  12. 12Evidence for Auditors: Logging, Oversight, DocumentationTamper-evident logs, a stop control that works, and docs generated from the repo.14 min

Evidence

5 sources

Third-party sources behind the book's premise. Every figure in them belongs to the party that published it and is attributed to them in the text.

Continue through the library

Adjacent operating manuals.

Cover of AI-Native Product Architecture by Vishal Rajpurohit

Architecture

AI-Native Product Architecture

Free to read · 12 of 12 chapters

Cover of Shipping With Agents by Vishal Rajpurohit

Engineering Leadership

Shipping With Agents

Free to read · 14 of 14 chapters