Research · Enforcement
Why Agent Security Must Happen at Execution Time
Every security decision in an agent is only as good as its enforcement. The strongest argument in agent security is also the simplest: you can only secure an action at the moment it executes, with full knowledge of what it is and where it came from. This article makes the case for action-time enforcement.
The timing problem
Security controls on an agent fall into two timing camps:
- Ingest-time. Decide at input: is this content dangerous? (Filtering, guardrails, classifiers.)
- Action-time. Decide at execution: may this action, from this provenance, execute?
Ingest-time controls must predict a future action from a past input. Action-time controls observe the actual action and judge it directly. Only the second can make a decision grounded in what's really about to happen.
What ingest-time can't know
Ingest-time blind spots
- It can't see the action. Content that looks benign at ingest ("the CEO's email is X") becomes dangerous only when the agent decides to use it to send something. Ingest-time doesn't know the action exists.
- It can't track derivation. A memory looks fine alone, but it was derived from a poisoned root. Only action-time, with the full provenance chain, can see that.
- It can't tell retrieval from permission. Whether content may cause an action is unknowable until an action is actually being proposed.
What action-time can enforce
At the moment an action is proposed, everything needed to make a correct security decision is available:
1
The actual actionNot a prediction — the real tool call, memory write, or message.
2
The full provenanceThe complete chain of content that drove this action, and their origins.
3
Authority re-verifiedDoes this provenance carry the right to do this action? High-risk needs sealed authorisation.
4
Enforce, fail closedBlock when uncertain or tampered — security is held, not hoped for.
The invariants only action-time can hold
- Origin-bound authority. The action's origin chain determines its authority — evaluated at execution.
- No derivation amplification. An action can't gain more authority than its provenance had.
- Retrieval ≠ permission. Recalled content drives the action, but the action is judged separately.
- Fail-closed tampering. If runtime state is tampered, execution blocks.
The bottom line: you cannot enforce a security decision you make before the action exists. Action-time revalidation is not one defense among many — it's the layer where agent security is actually decided and held.
Related reading
Open source. Independently built. Publicly benchmarked.