The threat model agentic systems actually face

Content the agent reads — a page, a document, a ticket — contains text directed at the agent. If the tool call is not independently authorized, the injected instruction executes with the agent's authority.

The agent acts on behalf of someone, but the acting identity and the principal are carried in the request body rather than established from an authenticated credential. Anything that can write the request can claim either.

The agent holds a credential broad enough to do far more than the task requires, so a single reasoning error or compromise produces an effect well outside the intended scope.

A retry, a replay or a crash between commit and acknowledgement produces a second real-world effect, because the effect was not reserved against a single intent.

The log is written by the same component that performed the action, with the same key. It attests to nothing an attacker who reached that component could not also write.

Authority is withdrawn, but work already approved and queued still executes, because revocation was not evaluated at dispatch.

Every governed action is authorized before it executes, not observed after. The decision to allow, hold or deny is taken against the active policy inside the same write transaction that reserves the budget and consumes the approval, so a policy change lands entirely before or entirely after an action — never halfway through one.

An agent's identity and its accountable owner come from the authenticated credential and the agent directory. They are never read from the request body. A request whose body disagrees with its credential is refused, and the refusal itself is recorded as signed evidence.

Decisions are produced by explicit rules over an explicit policy document with a version, not by a model's judgement. The same request under the same policy version yields the same decision, and the policy version that governed each decision is recorded in the signed evidence.

An action held for approval produces no effect until a separately authenticated human with the required role approves that exact request. The approval is bound to the payload and the envelope, is consumed once, and cannot release a different action or the same action twice.

An authorized operator can revoke an agent. Its next request cannot execute, and an action it had already had approved but not yet dispatched cannot execute either — revocation reaches work already in flight, not only new requests.

Spend and action limits are reserved atomically inside the authorization transaction. A limit lowered below what is already spent stops further spend without rewriting history, and the change is recorded as a signed configuration record naming the principal who made it.