AgentInterdict
Threat model

Threat model

A threat model is only useful if it is explicit. This page states what AgentInterdict is designed to protect, who the realistic adversaries are, where trust boundaries sit, and — crucially — the residual risks it does not eliminate.

Assets protected

  • Persistent memory — the long-term store of agent knowledge. Integrity here matters because corrupt memory corrupts future decisions.
  • Authority graph — the record of which origins are trusted and what authority they carry.
  • Credentials-not-memory — the property that secrets are not persisted in a usable form.
  • Tool-action integrity — the correctness of the enforcement decision attached to each action.
  • Audit log — the tamper-evident record of enforcement decisions, used for post-incident investigation.

Adversaries

  • Prompt-injection attackers — actors who embed malicious instructions in documents, emails, web pages, or other content the agent ingests, aiming to override the agent's intended behaviour.
  • Malicious content sources — compromised or hostile documents, email bodies, and web content that try to act on the agent.
  • Memory-poisoning actors — those who inject false "facts" into persistent memory so that they persist and corrupt future decisions.
  • Local-state tampering — actors who alter memory, the authority graph, or the audit log on the host to change enforcement outcomes.
  • Exfiltration attempts — attempts to read credentials or sensitive context out of the runtime and send it somewhere untrusted.

Trust boundaries

A core distinction AgentInterdict makes is between the origin of content and the content itself. Content is not trusted merely because it exists; it is treated according to the authority of its origin.

  • Retrieval is not permission. Reading a memory or document does not, by itself, authorise acting on it.
  • External sources are non-authoritative by default. Content from external, untrusted origins carries no standing authority over the agent's actions unless explicitly bound to it.
  • The trust boundary sits between trusted instruction/authority and untrusted ingested content. AgentInterdict enforces that boundary at the runtime.

Controls

  • Origin-bound authority — authority is keyed to the origin of an instruction, so untrusted content cannot simply claim the privileges of trusted content.
  • No derivation amplification — derived actions cannot exceed the authority of their provenance chain.
  • Action-time re-scoring — authority is re-validated at the point of execution, not only at ingestion.
  • Quarantine + atomic containment — suspicious memories are quarantined and their derivation chain contained atomically, so poison does not propagate.
  • Credential rejection — credential-shaped content is rejected or redacted before it can persist.
  • Fail-closed tamper detection — integrity seals on local state cause the runtime to block (flip to lockdown) when tampering is detected.

Residual risks

These risks remain after AgentInterdict's controls are in place. They are not solved by this tool and should be addressed by other means.

  • Model-level vulnerabilities. Behaviours of the underlying model that fall outside the runtime boundary are not enforced by AgentInterdict.
  • Supply-chain risk in dependencies. AgentInterdict depends on third-party libraries; a vulnerability in those dependencies is outside this tool's own enforcement surface.
  • Operator misconfiguration. If the operator misconfigures the runtime, sets keys too broadly, or routes actions around it, the guarantees weaken.
  • The tool's own dependencies. As an open-source project, AgentInterdict itself must be kept patched and audited.

Reporting issues

If you identify a gap between this model and reality, or a vulnerability in the tool, please report it responsibly. See our responsible disclosure policy.