Enforcement outside the model

The premise

In short: The model's behaviour can be manipulated through what it reads, so behaviour cannot be the foundation of a control.

An agentAgent. Software that uses an AI model to work toward a goal on its own: it reads, decides the next step, uses tools, and keeps going until the job is done or a limit stops it.'s behaviour is the output of a modelModel. The AI engine that reads and writes text. On its own it has no access to your systems; everything built around it decides what it may do., and the model's inputs can manipulate it. That makes behaviour the wrong foundation for a control. A model processes commands and content as one undifferentiated stream of text (token-uniform processing), so training alone cannot teach it to keep the two apart. Without a control that sits outside the model, authorization turns into a hunt for the next exploit. EchoLeak proved the class. It is catalogued as CVE-2025-32711 (Common Vulnerabilities and Exposures) and scored 9.3 on the 10-point Common Vulnerability Scoring System (CVSS). It exfiltrated data, pulling it out of the organisation through a retrievalRetrieval. Finding the few relevant pieces of company information for a task and placing them in front of the model. agent without the user clicking anything, working entirely in natural language. So enforcement lives outside the model, in three tiers.

Tier 1: the gateway

In short: Every request an agent makes to a tool goes through one door, and that door does the checking.

Every toolTool. A function an agent can call to do something real: look up a record, send an email, run a query. Tools are where agents touch your systems. call passes through the gatewayGateway. The single door every agent request passes through on its way to a tool or model. Because everything goes through it, it is where rules are enforced and activity is recorded., the single door between agents and the systems they touch. The gateway applies an allowlist of permitted tools, exchanges the caller's identity (token exchangeToken exchange (on-behalf-of). Swapping one credential for another so an agent acts with the permissions of the person who asked, not with its own broader powers.), and injects credentials. It also checks that each tool's description has not changed, applies rate limits, and records every call for audit. Approval rules may be held in the harnessHarness. The engineering shell around the model: what goes into its working memory, which tools it can call, when it must stop, how much it may spend, and how it recovers when something fails., the engineering shell around the model, because only the harness sees the whole loop. They are enforced at the gateway, because only the gateway cannot be talked out of them. Full detail is on the R03 page, which covers the integration fabric.

Tier 2: the policy decision point

In short: A fixed-rules component says yes or no to every consequential action, about a thousand times faster than an AI filter.

A deterministicDeterministic. Always gives the same answer for the same input by following fixed rules. The opposite of probabilistic, where the answer can vary. policy decision point (PDP)Policy decision point. The component that says yes or no to an action by checking rules against who is asking. The agent asks, the decision point decides, and the agent cannot skip it. sits in the tool-call path. It is the component that says yes or no to an action by checking rules against who is asking, and it is evaluated on every consequential action. Two engine families offer a real trade-off. Cedar-class engines answer in under a millisecond and are formally verified, but they are stateless. Open Policy Agent (OPA) class engines handle richer joins across data. Two complements apply where the workload warrants them. The first is deterministic information-flow control: FIDES, shipped in a major agent framework, scored zero policy-violating injectionsPrompt injection. An attack where instructions hidden in content the agent reads (an email, a web page, a document) trick it into doing something its user never asked for. on the AgentDojo benchmarkBenchmark. A public test used to compare models or agents. Useful for orientation; scores can be gamed, so they are claims rather than measurements., against 20 to 152 without it. The second is formal output verification: Automated Reasoning checks, generally available (GA) since August 2025 [vendor].

The cost argument is decisive on its own. A policy-engine evaluation takes under a millisecond to a few milliseconds. A guardrailGuardrail. A filter that uses an AI model to catch bad inputs or outputs. Useful as an early warning, but not reliable enough to be the thing that grants or denies an action. call that uses a large language model (LLM) takes around 1.5 seconds. That is a difference of roughly a thousand times (three orders of magnitude), paid on every action, forever.

Tier 3: promoted rules, landed outside the model

In short: A rule an agent learns only counts once it has passed testing and been written into policy outside the model.

Learned behaviour graduates into enforcement only through the learning flywheelLearning flywheel. The controlled loop that makes agents better over time: collect evidence, test, approve, roll out in stages, and pull back what fails. gate. The rule must survive counterexamplesCounterexample. A test case built from a real failure, used to prove that a proposed rule or change actually holds. (test cases built from real failures), pass evalEval (evaluation suite). A set of test tasks with known right answers, written by people who know the work, used to check an agent before and after any change. regression (the standing test suite), and receive human approval. The promotedPromotion and demotion. Promotion moves a proven improvement into production. Demotion pulls it back out when it stops passing. artifact then lands in policy-as-codePolicy-as-code. Rules written as versioned code that a computer evaluates the same way every time, reviewed and deployed like any software change., versioned and deployed independently of the model. A rule the model merely reads is still a soft rule. The ceiling on such rules is measured. A statement-by-statement analysis of real agent instruction files found roughly a quarter of statements enforceable by a fixed check as written. It found 74 percent depending on context that cannot be defined in advance. Formal work adds a second limit. Deterministic gates can enforce strictly less than edit automata, a more powerful class of enforcement monitor, so some rules about behaviour over time (renewal properties) stay out of reach. That ceiling is why tiers 1 and 2 exist.

What guardrails are for

In short: AI-based filters are a useful early warning, but attackers get past them most of the time, so they decide nothing that matters.

Guardrails are the advisory layer, never the boundary. In published tests, roughly 72 percent, 77 percent, and 72.5 percent of attacks got past three named commercial guardrail products, and up to 100 percent got past some configurations. The only configuration with a measured 0 percent bypass rate paid for it with 16.22 percent false positives and about 1.5 seconds of added latencyLatency. How long a request takes to come back. (delay) per call. A guardrail can also be made to deny service, and that denial is itself exploitable. Guardrails retain genuine value for content policy, detection of personally identifiable information (PII), and telemetryTelemetry. The stream of measurements a system emits about itself, collected centrally., where a miss is tolerable. Their block rate is monitored in both directions: a spike signals an attack, a drop signals misconfiguration.

The map

In short: Each kind of rule has one place where it is enforced, and a place where people wrongly assume it is.

The research behind this page

• Security and identity findings
• Intelligence and learning findings
• Integration fabric findings