Security and risk
- Written for
security-engineer- The decision it ends in
- Decide whether this changes the risk position for agents already running, and what it does not cover.
Where this starts
An AI agent in your estate can already reach the network, the filesystem and a shell. The controls you own were built for humans and for services: identity, review, change management, and logs you read afterwards. None of them sits between the agent’s decision and the agent’s action.
Your detection story is entirely retrospective, and your compensating control is that nobody has given the agents anything important yet — which stops being true the week a team ships an agent with a production credential.
What makes it this quarter’s problem
A team asks to run a coding agent against a repository that has deploy keys in it. You are asked to sign off, and the honest answer is that you have no mechanism to say what it may reach — only a mechanism to find out later.
What Agent Assembly does about it — and how far each answer reaches
Agent Assembly is a decision point placed in front of an agent’s actions, on the paths you route through it, plus the record of what it decided. For a security review, six entries carry the weight.
Each card below is one entry of a sixteen-entry claim register shared by all four of these pages, quoted rather than paraphrased. The term is the register’s own, copied off the evidence rather than chosen to suit the sentence; the bound beside it is part of the claim, not context for it. Every entry — including the ones this page does not cite — is published with the manifest rows behind it: the shared claim register.
A connection made on a path you routed through Agent Assembly is checked against the destination list you configured and refused before the proxy dials it.
Where this stops. The refusal is the proxy’s own local egress configuration, not a control-plane decision. The destination lists are empty by default — this refusal exists because an operator configured it. Linux release artifact; on macOS cargo install aa-proxy is the only route; on Windows there is no local mediation. If the proxy is not in front of the connection, the connection is simply made.
Requests to loopback, private, link-local and related address space are refused, including where a public hostname resolves into them.
Where this stops. On by default, fails closed, and no configuration relaxes it. It ranges over address space, not over an arbitrary public destination — it does not deliver RC1 and must not be credited with doing so.
An MCP tool call can be checked against your policy by the control plane and refused before the proxy forwards it.
Where this stops. The only gateway-bound pre-dial refusal in the product, and it is off by default. It reaches MCP sent as an ordinary HTTP/1.1 POST on an intercepted non-LLM host with a gateway endpoint configured. Tool servers over stdio — the most common setup — SSE and WebSocket have no interception mechanism; Streamable HTTP is recorded as functionally broken rather than merely uncovered.
On the model-provider hosts Agent Assembly inspects, a recognised credential is removed from the request before it is forwarded.
Where this stops. Three built-in hosts, because llm_only defaults on. The default action is redact and forward, not refuse. Recall is bounded by the pattern set — there is no Stripe detector. Model responses on that path are not scanned.
Where the control plane is configured and becomes unreachable, the decision path refuses rather than allowing.
Where this stops. Fail-closed on the paths that have a gateway: the runtime denies on an unreachable gateway, the proxy refuses to start, and the gateway aborts on a policy that fails to load. The inverse is not symmetric — a runtime with no gateway configured falls through to a local evaluation whose terminal default is allow. Configured-then-broken fails closed; never-configured fails open.
Whether a given decision’s record durably reaches the audit chain is not established. The verification tool is real — aasm audit verify-chain ships in the open-source build — but what it proves is the integrity of the entries that are present, not that any particular decision produced one.
Where this stops. The manifest’s only row for this subject is the row for what happens when the write fails, and it carries coverage: unmeasured, failure_posture: fail_open and evidence: gap. So the honest term is the row’s own. Everything else about the chain is a bound, not a capability: it is tamper-evident, not immutable and not signed — an unkeyed digest, so anyone able to rewrite the sink can recompute it. The chain head advances before the send and a full channel drops the entry while the call still returns, which makes a dropped entry indistinguishable from a deleted one. An emptied log verifies clean. The proxy writes no local record at all unless its audit path is configured. See the two gaps.
What is different after
For an agent you routed, a request to a destination outside the list you configured is refused before a connection is opened.
The security position that changes is ordering — the decision precedes the effect — not coverage, and not the completeness of the record: whether a given refusal’s entry durably reaches the audit chain is RC6, which is Unmeasured. Buy the ordering; do not buy a ledger.
What you can check, and where
The bypasses are enumerated and published rather than argued away — both as a limitations page and as the known-bypasses field of every row in the capability manifest.
The enumerated bypasses →The 80-row evidence base every sentence on this page resolves against, carrying each row’s coverage term, decision timing, default state, failure posture and evidence.
The capability manifest →The threat model, the trust boundaries and the audit properties — what chain verification does and does not establish.
The security model →Per-scenario decision, decider and boundary, each with the manifest rows it rests on.
Risk scenarios →What is on by default, row by row — the Level 3 table on the product promise. A capability that exists but is off is a different product from one that is on.
What is on by default →The claim discipline itself, including the wording this product refuses to publish and why no approval makes an unsupported absolute true.
The claim vocabulary →
What you would otherwise find out later
- Bypass resistance has exactly one rung and one row.Treat every other state — including GatewayProtected — as saying nothing about bypass resistance.— (ADR 0030 protection state)RC9
The managed launch for Claude Code on macOS is the one path that reaches ADR 0030’s HostEnforced rung.
Where this stops. ADR 0030 §4.1 makes HostEnforced the only state that claims bypass resistance, and exactly one manifest row carries it. Two things bound it hard. The rung rests on reading back a root-owned managed-settings file, and whether the tool honours those keys at runtime is unmeasured. And the manifest records the rung as unearned at the published v0.0.1-rc.6 tag — the evidence it rests on postdates the tag. macOS host-level interception itself is integrated, scoped to tool governance only: claim the file, never the enforcement.
- The destination lists are empty by default.Out of the box RC1 refuses nothing. The always-on one is RC2, and it ranges over address space rather than over destinations you name.
- Routing is per agent and per launch.An agent started outside the managed launch is outside the boundary, and that is not detectable from the inside (RC15).
- The largest gap is host actions.A shell command or subprocess spawned by a native agent process has no interception mechanism at all in a released build; browser automation and database queries likewise. The policy language can express these rules; nothing released can act on them.
- Uninspected is not clean.UnmeasuredRC7
Where nothing inspected an action, the record says nothing was inspected — not that it was allowed.
Where this stops. Scoped to the action or payload, never to the connection: a host the proxy does not intercept is still adjudicated at CONNECT, so its connection is Observed while its payload is Unmeasured. One live defect runs against this rule today — the CONNECT-level event still records an allow for traffic about to be tunnelled uninspected (AAASM-5637) — so state it as the rule and the open defect together, not as finished behaviour.
- The evidence is tamper-evident, not immutable, and it can be lost.A dropped entry is indistinguishable from a deleted one, and no manifest row establishes that a decision’s record durably arrives at all — the term is Unmeasured (RC6). Do not present the audit chain as the control that satisfies a retention or non-repudiation requirement.
- The agent plane accepts unauthenticated callers.A deliberate bootstrap path with a bounded exposure, and still not an authenticated plane.EvaluatedRC16
An agent registers with an Ed25519 did:key identity and a possession proof, and delegation lineage is derived server-side.
Where this stops. The agent plane is reachable without authentication by design, as a bootstrap path: an unauthenticated caller that can reach it can register and can submit policy queries. Those queries are evaluated with tenancy neutralised rather than with the caller’s own, so the exposure is that the plane accepts the call. Org scoping is applied per call site rather than at the storage layer. Do not describe the agent plane as authenticated.
- Approval required is not a capability you can buy today.Approval requiredRC12
No claim.
Where this stops. No manifest row reaches this term. The hold itself is real in the gateway path and fails closed on timeout, but no shipped operator surface can answer it, and inside the MCP tunnel a pending decision is downgraded to a refusal, so a human cannot be reached there either. AAASM-5657.
- Windows has no local mediation.UnsupportedRC14
Named transports and platforms are not available, and the matrix says which.
Where this stops. Windows has no local mediation of any kind. UDP, QUIC and HTTP/3 are outside the transport set; so are HTTP/2, gRPC and WebSocket over an intercepted host, and MCP over WebSocket. Unsupported for one element is not Unsupported for the product.
One page to read, one thing to do
Read the security model — the threat model, the trust boundaries, and what the audit chain does and does not establish.
The security model →Then check your own platform and channel position before scoping a trial — the answer differs by operating system and by how you installed, and it decides which of the above you can actually run.
The compatibility matrix →