Isolation Patterns for Untrusted Agents

Not all agents in a system are equally trustworthy. Third-party agents, community-contributed agents, or agents that process raw user input should be treated as untrusted. Isolation patterns allow these agents to participate in workflows without having direct access to sensitive resources or trusted communication channels.

Sandbox Execution

Run untrusted agents in sandboxed environments with restricted system access. Containers with limited network access, capped memory, and no filesystem persistence provide baseline isolation. The sandbox prevents a compromised agent from accessing host resources or other agents' data.

Proxy-Mediated Communication

Untrusted agents should never communicate directly with trusted agents. Route all communication through a proxy that validates messages, strips suspicious content, and enforces schema compliance. The proxy acts as a security boundary between trust domains.

[Untrusted Agent] -> [Proxy/Gateway] -> [Trusted Agent]
                      ^
                      |
                  Validates, filters,
                  rate-limits

Output Quarantine

Before an untrusted agent's output enters the trusted pipeline, quarantine it. Run the output through Aegis content scanning, validate it against expected schemas, and check for known injection patterns. Only after the output passes all checks does it proceed to trusted agents.

Resource Quotas

Enforce strict resource quotas on untrusted agents. Limit API calls per minute, tokens consumed per request, and total compute time per session. This prevents resource exhaustion attacks where a compromised agent attempts to consume all available resources.

Capability-Based Access

Instead of role-based access, use capability tokens for untrusted agents. Issue narrow, time-limited tokens that grant access to specific operations. The token is required for every action and is validated by the policy engine. Revoke tokens immediately if anomalous behavior is detected.

Authensor policies enforce isolation at the action level. Even if sandbox isolation fails, policy evaluation rejects unauthorized actions from untrusted principals.

Assume untrusted agents will be compromised. Design the isolation so that compromise does not matter.