Security model
AgentInterdict is a local, open-source runtime enforcement tool for autonomous AI agents. This page describes how it is built to be safe, what it protects, and — just as importantly — what it does not do.
Overview
AgentInterdict enforces six invariants at the runtime boundary of an autonomous agent. These are the properties the software is designed to hold:
- Origin-bound authority — authority to act is bound to the origin of the instruction, not merely its content. Content from untrusted origins does not carry the authority of trusted ones.
- No derivation amplification — an action cannot gain more authority than the provenance chain that produced it.
- Retrieval ≠ permission — reading a memory does not, by itself, authorise acting on it. Retrieval and authorisation are separate checks.
- Action-time re-scoring — decisions are re-validated at the moment an action executes, not only when context was ingested.
- Credentials-not-memory — credential-shaped content is rejected or redacted so that secrets never persist to long-term memory.
- Fail-closed tampering — if local state is detected as tampered with, the runtime blocks by default rather than continuing.
Local by construction
AgentInterdict runs entirely on the operator's own hardware. The agent's context — its prompts, retrieved documents, tool outputs, and memories — never leaves the machine on which the runtime runs.
- No cloud dependency. The enforcement logic is fully local.
- No telemetry. By default the tool reports no usage data back to us.
- No data exfiltration by construction. Because context never leaves the host, there is no remote path for it to leak through the tool itself.
This is a design property, not a claim about the wider host. Anything else on the machine, or any network call the agent itself makes, is outside this guarantee.
Fail-closed default
When the runtime cannot confidently allow an action, or detects that its own state has been altered, it defaults to blocking rather than allowing. This applies to tampering, invalid provenance lineage, and lockdown scenarios.
Runtime modes:
normal— full enforcement: provenance, trust, and authority are verified before execution.read_only— memory writes and mutating actions are blocked; reads and analysis still proceed.lockdown— all actions are blocked. The runtime exposes read-only state for investigation only. Tamper detection flips the runtime to this mode.
Privilege separation
Operator and runtime API keys are distinct and separately scoped. An operator key can administer and configure the runtime; an ordinary runtime key used by the agent itself has a narrower permission set. This separation means a compromised agent key does not, by itself, grant administrative control over the enforcement layer.
Data handling
Stored locally by the tool:
- Persistent memories written by the agent
- The authority / trust graph
- The audit log of enforcement decisions
- Integrity seals used for tamper detection
Never stored by the tool:
- Plaintext credentials or API keys in memory
- Private keys
Credential-shaped content is redacted to a non-reversible reference (a hash) rather than persisted in a usable form.
Known limits
AgentInterdict is honest about what it is and is not. It is a runtime-boundary enforcement tool, not a model-level guarantee.
- Not a model-level guardrail. It does not change the model's weights, fine-tune safety, or otherwise control the model itself.
- Enforces at the runtime boundary. It inspects and gates actions that pass through its runtime. Actions that bypass the runtime are not enforced.
- It does not make prompt injection impossible. It reduces and contains the impact of untrusted content; it does not guarantee injection can never succeed.
- Not a substitute for host security. Host permissions, least-trust, sandboxing, OS isolation, and human approval for high-impact actions remain your responsibility.
Reporting vulnerabilities
If you believe you have found a vulnerability in AgentInterdict, please report it responsibly. See our responsible disclosure policy for how to contact us and what we commit to.