{ "id": "artifact:the-agent-is-not-the-security-boundary", "slug": "the-agent-is-not-the-security-boundary", "title": "The Agent Is Not the Security Boundary", "thesis": "Do not ask whether the agent is trustworthy. Ask whether the system remains safe when the agent is wrong.", "abstract": "A first-person systems essay about model judgment, harness enforcement, external platform controls, and evidence and recovery as the real security boundary around coding agents.", "topics": [ "agentic-systems", "security-boundaries", "sandboxing", "least-privilege", "evidence-recovery" ], "date": "2026-07-25", "dateLabel": "Source dated", "published": false, "publicationState": "PREVIEW_READY", "updated": "2026-07-25", "sourceDates": { "created": "2026-07-25", "updated": "2026-07-25" }, "kind": "Systems Essay", "sourceFamily": "SharePlane Platform", "href": "artifacts/the-agent-is-not-the-security-boundary/index.html", "contextHref": "records/the-agent-is-not-the-security-boundary/context.txt", "recordHref": "records/the-agent-is-not-the-security-boundary/work.json", "receiptHref": "records/the-agent-is-not-the-security-boundary/receipt.json", "packageHref": "downloads/works/the-agent-is-not-the-security-boundary.zip", "canonicalUrl": "https://shareplane.malott.ai/artifacts/the-agent-is-not-the-security-boundary/", "sources": [ { "id": "source:shareplane-platform-issue-124", "type": "owner-accepted-semantic-authority", "title": "The Agent Is Not the Security Boundary", "locator": "https://github.com/pinklon/shareplane-platform/issues/124", "role": "Governs the accepted semantics, claim postures, canonical article source, information design, and Creative Lock.", "description": "Issue-backed semantic authority; implementation does not reopen the accepted thesis.", "publiclyExposed": true }, { "id": "source:shareplane-platform-issue-126", "type": "bounded-implementation-authority", "title": "Implement The Agent Is Not the Security Boundary", "locator": "https://github.com/pinklon/shareplane-platform/issues/126", "role": "Governs article-scoped implementation, exact-head Development preview, and the owner-UAT stop.", "description": "Implementation authority only; ready-for-review, merge, production, and writer release remain prohibited.", "publiclyExposed": true }, { "id": "source:shareplane-platform-issue-92-stop", "type": "direct-operational-receipt", "title": "Fail-closed authority preflight receipt", "locator": "https://github.com/pinklon/shareplane-platform/issues/92#issuecomment-5064671946", "role": "Demonstrates a public-safe stop before mutation when a required relationship identity was absent.", "description": "A direct operational receipt of successful stop-on-ambiguity behavior; it contains no credential-bearing detail.", "publiclyExposed": true }, { "id": "source:openai-running-codex-safely", "type": "first-party-operational-guidance", "title": "Running Codex safely at OpenAI", "locator": "https://openai.com/index/running-codex-safely/", "role": "Supports claims about complementary sandbox and approval controls, constrained network policy, credential storage, managed configuration, and agent-aware telemetry.", "description": "OpenAI's internal deployment pattern is scope-limited and is not presented as a universal product default.", "publiclyExposed": true }, { "id": "source:openai-codex-agent-loop", "type": "first-party-engineering-documentation", "title": "Unrolling the Codex agent loop", "locator": "https://openai.com/index/unrolling-the-codex-agent-loop/", "role": "Supports the harness, tool-loop, shell-permission, and external-tool boundary descriptions.", "description": "The Codex shell sandbox does not automatically establish equivalent guardrails for externally provided tools.", "publiclyExposed": true }, { "id": "source:openai-gpt-5-3-codex-system-card", "type": "first-party-deployment-safety-documentation", "title": "GPT-5.3-Codex System Card", "locator": "https://deploymentsafety.openai.com/gpt-5-3-codex/introduction", "role": "Supports current, interface-qualified descriptions of isolated cloud containers, local sandboxing, and network-risk mitigations.", "description": "Exact behavior varies by interface, operating system, version, administrator policy, and configuration.", "publiclyExposed": true }, { "id": "source:openai-windows-sandbox", "type": "first-party-engineering-documentation", "title": "Building a safe, effective sandbox to enable Codex on Windows", "locator": "https://openai.com/index/building-codex-windows-sandbox/", "role": "Supports the interface-qualified description of operating-system-enforced local sandboxing.", "description": "A platform-specific engineering account, not a guarantee that every local configuration has identical containment.", "publiclyExposed": true }, { "id": "source:nist-sp-800-207", "type": "authoritative-security-architecture-guidance", "title": "Zero Trust Architecture, SP 800-207", "locator": "https://www.nist.gov/publications/zero-trust-architecture", "role": "Grounds the resource-centric, explicit-access, least-privilege identity adaptation.", "description": "NIST SP 800-207 is not a coding-agent implementation standard; this is an explicitly labeled architectural application.", "publiclyExposed": true }, { "id": "source:nist-ai-rmf-1", "type": "authoritative-risk-management-guidance", "title": "Artificial Intelligence Risk Management Framework 1.0", "locator": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10", "role": "Supports continuous governance, testing, monitoring, incident handling, and human oversight across the lifecycle.", "description": "Voluntary, technology-neutral guidance; it does not prescribe SharePlane's ticket-first or exact-head workflow.", "publiclyExposed": true }, { "id": "source:nist-ai-600-1", "type": "authoritative-generative-ai-risk-guidance", "title": "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile", "locator": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence", "role": "Extends lifecycle risk-management guidance for generative-AI systems.", "description": "Supports high-level control principles without claiming a product-specific implementation guarantee.", "publiclyExposed": true }, { "id": "source:owasp-llm01-prompt-injection", "type": "application-security-guidance", "title": "LLM01:2025 Prompt Injection", "locator": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/", "role": "Supports prompt injection as a first-class agent-system risk whose impact depends on available agency.", "description": "Injection does not automatically cause material damage; the path depends on tools, identity, permissions, validation, and independent controls.", "publiclyExposed": true }, { "id": "source:owasp-llm06-excessive-agency", "type": "application-security-guidance", "title": "LLM06:2025 Excessive Agency", "locator": "https://genai.owasp.org/llmrisk/llm062025-excessive-agency/", "role": "Supports the excessive-functionality, excessive-permission, and excessive-autonomy framing.", "description": "A useful taxonomy, not a complete threat model; identity, supply chain, data, evidence, and recovery remain necessary.", "publiclyExposed": true }, { "id": "source:shareplane-platform-issue-18", "type": "related-work-authority", "title": "The Agent Worker Should Leave the System Smarter", "locator": "https://github.com/pinklon/shareplane-platform/issues/18", "role": "Related work on evidence, learning, and the operating state left behind by an agent worker.", "description": "Related semantic lane; it is not implementation authority for this artifact.", "publiclyExposed": true }, { "id": "source:shareplane-platform-issue-116", "type": "related-work-authority", "title": "Build the Path Before You Optimize the Machine", "locator": "https://github.com/pinklon/shareplane-platform/issues/116", "role": "Related work on proving a bounded operating path before optimizing its machinery.", "description": "Related delivery-method lane; it is not implementation authority for this artifact.", "publiclyExposed": true } ], "posture": "Owner-originated first-person operating thesis with accepted semantics, a current bounded evidence ledger, and a selected Creative Lock under Issues #124 and #126.", "media": [], "schema": "shareplane.portable-work.v1", "author": { "name": "Tony Malott", "url": "https://malott.ai/" }, "content": { "mediaType": "text/plain", "path": "records/the-agent-is-not-the-security-boundary/context.txt", "sha256": "7576774d1d83871efe2c2c4885b111b4601605131387be6bdac4b22055cad0a2", "complete": true, "extraction": "Native presentation reading order; scripts, styles, and platform chrome excluded." }, "relationships": [ { "source": "artifact:the-agent-is-not-the-security-boundary", "target": "artifact:the-agent-is-not-the-product-the-control-plane-is", "type": "companion", "group": "foundations", "label": "Companion: The Agent Is Not the Product", "explanation": "Continue from the security boundary into the control-plane architecture that governs work around the agent." }, { "source": "artifact:the-agent-is-not-the-security-boundary", "target": "artifact:the-agents-were-never-the-bottleneck", "type": "companion", "group": "counterpoints", "label": "Companion: The Agents Were Never the Bottleneck", "explanation": "Connect bounded agent authority to the operating discipline required when orchestration, evidence, and integration become the real constraints." } ], "representations": { "html": "artifacts/the-agent-is-not-the-security-boundary/index.html", "text": "records/the-agent-is-not-the-security-boundary/context.txt", "json": "records/the-agent-is-not-the-security-boundary/work.json", "package": "downloads/works/the-agent-is-not-the-security-boundary.zip" } }