Collection
Patterns
Control patterns that sit beside the posts. Tagged patterns also appear on topic pages with matching posts.
Prompt-Independent Action Authorization
Treat a leaked prompt as reconnaissance, then prove the target service still rejects out-of-scope actions regardless of the words the model uses.
Source-Bound CI Attestation
Treat a passing PR check as an attestation from a designated runner about an exact revision, not as a green string any repository writer can supply.
Quarantine Unreviewed Installs
Let PR validation execute lifecycle hooks only in a worker whose credentials, network and output cannot become release authority without review.
Retrieved Evidence Promotion Gate
Keep source claims and embedded instructions out of application authority, even when the poisoned chunk wins retrieval.
Effect-Bound Tool Route Gate
Authorize the effect at the service, regardless of which agent tool pipeline requested it.
Retrieved Context Action Boundary
Treat every retrieved chunk as evidence with provenance, while reserving tool and policy authority for a separate application-controlled gate.
Resource-Bound Action Budget
Keep conversation policy for sequencing, but enforce cumulative limits in an atomic resource ledger across sessions and retries.
Verdict Coverage Accounting
Join independent request counts to hook verdicts and configuration state so silent inspection gaps are observable and high-impact actions stay gated.
Evidence-Bound Callback Completion
Accept a completion as a scoped claim, then verify independent evidence and current authorization before the next side effect.
Task-Bound Artifact Fetch
Translate an external agent's file reference into a narrowly authorized fetch and a receipt for the bytes actually consumed.
Pre-Dispatch Side-Effect Gate
Separate blocking run admission from a mandatory target-facing decision so a late tripwire cannot masquerade as prevention.
Unsampled Action Receipt
Preserve gate decisions and target outcomes even when agent traces are sampled out or filtered.
Purpose-Bound Handoff Packets
Give each specialist only the authenticated fields its task requires, and test the input it actually receives.
Telemetry-as-Evidence Incident Gate
Let an assistant inspect attacker-influenced logs without allowing their prose to close incidents or authorize response actions.
Replay-Fenced Agent Side Effects
Give one approved intent one durable target-side identity, regardless of workflow retries, forks or restarts.
Revocable A2A Push Subscribers
Make a task's outbound update subscription expire with its subscriber's entitlement, including queued retries.
Adjudicated Feedback Promotion
Keep production complaints useful for finding failures without letting them decide what a secure agent should do.
Revocation-Aware Policy Gates
Make policy freshness an explicit precondition for privileged agent actions, and prove revocations take effect at every serving gate.
Enforced Filesystem Scope for MCP Servers
Treat selected directories as intent and constrain the server process to the files it may actually open.
Same-User Elicitation Binding
Require the browser principal completing an MCP URL elicitation to match the authenticated principal that initiated it.
Task-Bound A2A Authorization
Bind every task read, stream and mutation to the authenticated caller's ownership and action rights, not possession of its ID.
Three-Pillar Agent Containment
Pre-engineer independent response controls over an agent's authority, connectivity and execution.
Cross-Boundary Action Evidence
Correlate policy, dispatch and target events without confusing transport success with business outcome.
External Agent Policy Enforcement
Keep authoritative policy outside the agent's control and require its decision at every consequential service boundary.
Outcome-Based Guardrail Assurance
Test prevention, detection and response against observable actions in a controlled environment.
Revocable Delegation Boundary
Bound cross-agent authority and verify that revocation reaches delegated execution.
Sandbox Visibility Contract
Establish which workload behaviours are observable, attributable and actionable inside an isolated agent runtime.
Approval Bound to Action
Preserve the exact action a person reviewed, then verify and consume its approval at the execution boundary.
Permission Freshness at Retrieval
Enforce caller access before model context assembly and place an explicit limit on stale permission state.
Skill Grant on the Hop
Enforce skill-level policy at the receiving agent, then bind a durable authorization receipt to the call before it runs.
Verified Dispatch Path
A control pattern for security architects and platform teams who run agent harnesses with model-layer guardrails. It treats a green dashboard as worthless unless tool dispatch requires a trusted execution record and an explicit policy decision — so forged history and co-opted judges cannot wave traffic through.
Verified Agent Containment
A control pattern for security architects and platform teams who run coding agents or MCP-backed tools on shared hosts. It replaces the comfort label “sandbox on” with an explicit, checkable isolation boundary so the agent cannot silently inherit the estate’s network paths and cloud identity.