202610 essays
A Threat Model for the Decision Itself
Security can protect the model, data, identity, network, and tool while the resulting decision still acquires more authority than its evidence can support.
A link assembled by an agent can disclose information before anyone visits it, which makes URL construction a data-egress decision rather than a formatting detail.
An agent identity is incomplete unless a system can say whose authority it exercises, for which task, under what limits, and until when.
The safeguard needs a maintenance budget
A safeguard that worked at launch becomes a historical claim unless someone funds the monitoring, updating, and renewed evidence needed to keep it effective.
The evaluator needs the failed trace
Aggregate scores can count failures while concealing whether an agent misunderstood, exceeded authority, recovered by luck, or caused harm on the way to success.
The permission boundary is an interface
Agent permissions should be designed as a visible, task-specific interface that makes authority legible before an action, not reconstructed after it.
The protocol is a new trust boundary
Open agent protocols create useful interoperability by moving instructions, tools, and context across systems—and every crossing creates a boundary that must be governed.
The monitor must outlive the model
Monitoring tied to one model or vendor cannot provide institutional continuity when agents, policies, and providers change beneath the work.
The security log needs the intent
A complete list of agent actions can still be an incomplete security record if it does not preserve the task, authority, and expected boundary behind them.
The standard will have to test the system
Agent standards will remain paper agreements unless conformance tests examine identity, tools, delegation, failure, and evidence across a working system.