Agent Guard: Kernel-Enforced Damage Boundaries for AI Agents via Human-Authorized Contracts

In the modern digital landscape, artificial intelligence has evolved from a simple text generator into a proactive worker capable of planning complex tasks, running programs, and interacting with the files and networks on a computer. This new autonomy, however, brings a specific kind of risk: if the AI makes a mistake, gets tricked by a malicious prompt, or simply hallucinates a dangerous instruction, it can execute commands that damage the very system it is supposed to help. Traditional security measures often act like a bouncer at a club door, checking a tool's name before letting it in, but they struggle to track what happens once that tool opens a shell, spawns a child process, or writes a file that later gets read by another program. Once the AI slips past the initial check, its actions can ripple through the operating system, leaving security teams unable to tell which part of the execution was authorized and which part caused the harm.

To solve this, researchers have developed a system called Agent Guard, which acts as a continuous, unblinking monitor inside the computer's core, or kernel. Instead of trusting the AI to follow the rules or relying on the AI to suggest what should be allowed, this system requires a human to confirm the boundaries before the AI is allowed to run. The human authorizes a specific set of rules for the AI's actions, and the computer's operating system then enforces these rules with absolute certainty. If the AI tries to do something outside its authorized scope, the system stops it instantly, long before any damage can occur. This approach shifts the focus from trying to predict every possible mistake the AI might make to creating a rigid, unbreakable fence around the specific assets the human has decided are safe to touch.

The researchers built this system by creating a special gate that sits between the human's authorization and the AI's execution. Before the AI is allowed to run any code, a human must review a proposed plan and confirm exactly which files and network connections the AI is permitted to access. This confirmation is not just a suggestion; it is a formal contract that the computer's operating system locks into place. The system then binds this contract to the specific task the AI is about to perform. If the AI tries to run a command that violates this contract, the operating system denies the request immediately. Crucially, the system does not just check the initial command; it watches the entire chain of events. If the AI writes a file, and that file is later read by another program, the restriction travels with the file. If the AI opens a network connection, the system ensures that no data can leave the computer if the contract forbids it, even if the connection was established before the restriction was fully applied.

To achieve this level of control, the researchers used a technology that allows the system to attach directly to the operating system's internal hooks. They created a data plane that tags every process, file, and communication channel with a specific status. When a process reads a restricted file, it inherits the restriction. When it writes to a pipe or a socket, the restriction passes to the other end. This propagation is monotonic, meaning once a restriction is applied, it cannot be removed by the AI simply by restarting a program or renaming a file. The system ensures that the "no-go" status spreads through the network of processes like a stain that cannot be washed out, preventing the AI from laundering its actions through intermediate steps to bypass the rules.

The team tested this system rigorously to see if it could actually stop the damage it was designed to prevent. They ran hundreds of formal security tests covering nineteen different scenarios, including cases where the AI tried to access files it shouldn't, send data over the network after being restricted, or pass restrictions to other programs. In every single one of the 570 test records, the system performed exactly as intended. It successfully denied unauthorized actions, propagated restrictions correctly across different types of files and communication channels, and ensured that no side effects occurred outside the agreed-upon boundaries. The system proved that it could maintain a strict, human-authorized damage boundary without ever needing to trust the AI's own judgment or its policy suggestions.

Beyond just proving it worked, the researchers measured how much this extra layer of security slowed down the computer. They compared their system against a previous method called ActPlane, which is a similar security tool. In tests involving file reading and writing, the new system added a delay of roughly 12 percent compared to a computer with no security measures at all. In contrast, the older system slowed the computer down by between 33 and 61 percent, depending on the task. This significant difference suggests that the new approach is not only more secure but also much more efficient, making it practical for real-world use where speed matters. The researchers found that the cost of checking the rules and tracking the flow of data was minimal, especially when compared to the heavy overhead of the previous generation of tools.

The study also highlighted what the system does not do, which is just as important as what it does. The system does not claim to fix every possible problem with AI safety, nor does it guarantee that the human's initial decision was the perfect one. It simply ensures that whatever the human decides is the rule, the computer follows that rule without fail. It does not protect against assets that were never declared, nor does it stop an AI from causing harm if the human explicitly authorizes a dangerous action. The system is a tool for enforcement, not a substitute for human judgment. It takes the complex, often vague idea of "safe AI" and turns it into a concrete, technical reality where the boundaries are defined by a person and enforced by the machine.

In the end, the work demonstrates that it is possible to create a safety net for artificial intelligence that is both strict and efficient. By separating the role of the AI, which suggests actions, from the role of the human, who authorizes them, and then using the operating system to enforce those authorizations, the researchers have created a model where damage is bounded and predictable. The system does not rely on the AI to behave well; it relies on the operating system to prevent the AI from behaving badly. This shift from trusting the agent to enforcing the contract represents a fundamental change in how we might secure the future of autonomous computing, ensuring that even if the AI makes a mistake, the consequences are contained within the walls the human built.