Designing boundaries for tool-using agents

Technical note · 26 October 2026. This describes design questions for AGIACC’s planned reference platform and SDK. Current company evidence consists of research and artifacts.

Start with authority

#

An agent that can run commands, read documents, and call business tools crosses several trust boundaries. Our design question is how to give each operation enough authority to complete its task while bounding the consequences of faulty code or an unsafe decision.

The proposed reference workflow separates the planner, tool execution, credential access, and policy checks. Permissions should name the resource, operation, and scope. Sensitive actions need an explicit authorization path, with records of the decision and outcome.

Combine containment with prevention

#

Sandboxes can restrict filesystem, network, process, and resource access. A practical boundary combines mechanisms and a clear policy: the Linux kernel documentation explicitly treats seccomp as one building block, rather than a complete sandbox.

Capability-based memory protection is another research direction for isolating native components. CHERI supplies primitives that require integration with a compiler, runtime, and application policy. Hardware checks do not establish whether a permitted business action is appropriate.

Make the boundary observable

#

A useful demonstrator should show an allowed task, a denied action, a component fault, and recovery. Evaluation should record what was contained, which assumptions remain trusted, and the latency and resource costs. These are planned acceptance criteria, not released AGIACC product results.

See the company roadmap for the current sequence of work.