The Agent Trust Boundary
Identity, permissions, and blast radius for software that acts on its own
An agent is a new principal in your system rather than a feature of your application, so its security comes from where you draw its boundary and never from prompt hygiene.
Assume the injection succeeds. That single assumption reorganises the whole problem: security stops being a matter of instruction wording and becomes a question of identity, authority and containment. This book draws the boundary, covering who the agent is, what it may call, where its code runs, what it may reach and what it may remember, and places enforcement outside the model, at the gateway, the tool or the destination system. It ends with the evidence an auditor asks for, because from 2 August 2026 some teams have to produce it.
What it makes operable
- 01
Map the trust boundaries of an agentic system and name every principal inside it
- 02
Give each production agent one identity and enforce its authority outside the model
- 03
Choose an execution sandbox that matches code nobody has reviewed
- 04
Produce the logging, oversight and documentation evidence an auditor asks for
Contents
12 of 12 published
Every chapter is free to read in the browser, cites its own sources, and stands on its own if you came for one decision rather than the whole argument.
- 01The Agent Is a Principal, Not a FeatureWhat changes the moment software starts acting under an identity of its own.11 min
- 02Mapping Trust Boundaries in an Agentic SystemDrawing the lines between model, tools, data sources, other agents and people.11 min
- 03Indirect Prompt Injection as the Default ConditionDesigning on the assumption that the injection lands.11 min
- 04Least Privilege at the Tool LayerCapability reduction per data source, enforced by the tool rather than the prompt.11 min
- 05One Identity per AgentWorkload identity, short-lived credentials, and an explicit authority record.11 min
- 06Authorization Enforced Outside the ModelMoving the decision to the gateway or the destination system.12 min
- 07Running Code Nobody ReviewedMatching isolation, from hardened container to user-space kernel to microVM, to the threat model.12 min
- 08Egress Control and Data ExfiltrationDeterministic network blocks as the last defence that still works.13 min
- 09Memory and Context PoisoningQuarantining what an agent is allowed to believe about its own past.12 min
- 10Inter-Agent Communication and Cascading FailureSigned identity across a boundary, and containment when one agent is wrong.12 min
- 11Supply Chain: Models, Prompts, Servers, SkillsInventory and provenance for everything an agent loads at runtime.13 min
- 12Evidence for Auditors: Logging, Oversight, DocumentationTamper-evident logs, a stop control that works, and docs generated from the repo.14 min
Evidence · 5 sources
Third-party sources behind the book's premise. Every figure in them belongs to the party that published it and is attributed to them in the text.
In the age of AI
The advantage was never the model. It's knowing what to build with it — and having a team that can actually ship it.
That's the part I help with: finding where AI genuinely makes your business faster, deciding what's worth building, and standing behind it once it's live.
Four offices, one very full passport
Every dot on this map is a conversation I still remember.
- Where I've spoken
- Office
