Building Security Agents That Cannot Escape Their Trust Boundary

The article argues that security agents powered by AI models require strict architectural constraints to prevent them from escaping their intended boundaries and accessing live infrastructure or data they shouldn't. Rather than relying on access control filters that models might circumvent, the author advocates for a "sandbox and action-gate" approach where the agent's code runs in an isolated environment with no external access, and all infrastructure calls are pre-authorized against read-only policies before credentials are attached. This design ensures the agent has the flexibility to reason about real data while being physically incapable of modifying infrastructure or exfiltrating information, regardless of what the model attempts to do.