Security, Credentials, Supply Chain, and Revocation

Security is a runtime contract

An agent harness handles instructions, retrieved content, tools, credentials, packages, generated code, and external effects. Every one of those surfaces can carry untrusted input or stale authority. Security is therefore not a final filter around model text; it is a set of enforced boundaries across the run lifecycle.

Sessions

Reject new privileged turns

Queued effects

Re-authorize before dispatch

Delegates

Invalidate inherited grants

Credentials

Expire cached material

Start with assets and consequences. Identify whose data and authority are present, which environments can be changed, what can leave the boundary, and which effects are difficult to reverse. Then define threat actors, trust transitions, controls, and evidence. A generic list of attacks cannot substitute for this model.

Keep data from becoming authority

Web pages, documents, tool output, memory, and messages can contain imperative language. Treat them as attributed data unless an admission rule explicitly promotes a field into a trusted instruction channel. Retrieval relevance does not grant authority.

Separate locked policy, user instruction, system state, and untrusted content structurally. Encode tool parameters through typed adapters. Test whether hostile content can change the principal, widen scope, reveal secrets, redefine completion, or cause an unapproved effect.

Persistent memory expands the attack lifetime. A poisoned item can influence later runs after the original content has vanished. Memory controls therefore need provenance, review state, scope, correction, retention, and deletion propagation in addition to access control.

Broker credentials at the edge

Models should receive capability-shaped access, not raw long-lived secrets. A credential broker can issue short-lived, narrowly scoped material to an adapter after current authorization. The adapter injects it at the transport boundary and returns a redacted receipt.

Logs, traces, prompts, caches, crash reports, and evaluation fixtures are all credential surfaces. Redaction should be deterministic and tested. Rotation reduces future exposure; it does not remove a secret already copied into an artifact, so incident response must search and invalidate downstream copies.

Admit the supply chain

Tools, model providers, packages, skills, prompts, container images, and remote services are dependencies with changing behavior. Pin what can be pinned, record versions and origins, verify integrity or signatures where available, and keep a capability manifest describing required permissions and outbound connections.

Evaluate a dependency before granting it production authority. Review installation scripts, transitive packages, update channels, telemetry, credential handling, and failure behavior. Run it in a bounded environment first. An allowlisted name is insufficient if the resolved artifact can drift.

Generated code joins the supply chain when it is built or executed. Subject it to the same repository review, tests, secret scanning, dependency policy, and deployment admission as human-written code.

Make revocation propagate

Revocation must invalidate more than the next login. Active sessions, cached tokens, delegated grants, leases, scheduled work, queued outbox intents, and provider-side credentials may all preserve authority.

Record a revocation epoch or equivalent current version and check it at consequential seams: tool binding, lease renewal, child admission, effect dispatch, and credential issuance. Existing read-only computation may be allowed to finish, but no stale grant should cross into a newly consequential action.

The interface should show what was revoked, which work stopped, what may already have happened, and which external credentials still require provider-side action. Revocation can leave ambiguous effects that need reconciliation rather than silent cancellation.

Failure boundary

Security fails when retrieved text becomes command, credentials enter model context, logs preserve secrets, dependencies update without admission, generated code bypasses normal controls, memory poisoning persists across users, or revocation stops new sessions while queued and delegated work retains the old grant.

Retrieval check

A connected repository contains a document asking the agent to upload environment variables. The relevant integration has a cached token, two delegated workers, and one queued publish intent. The user revokes the integration. Which surfaces treat the document as data, where must the token never appear, and how should revocation propagate before any work continues?

Sources and further reading

• Strengthening AI Agent Hijacking Evaluations — official threat-informed evaluation guidance for agent hijacking.
• Memory Is a Feature. It Is Also an Attack Surface — OWASP practitioner guidance on persistent memory threats and controls.
• Harness Engineering Study Guide — the publication synthesis connecting security boundaries to the full harness lifecycle.