Where Security Fits in an AI Agent Stack

Summary

The post explains where security controls should sit in an emerging AI agent stack as agents gain capability and operate over longer horizons. It distinguishes behavioral controls in models and harnesses, which guide proposed actions, from authoritative infrastructure controls that bind identity, enforce policy, contain failures, and record activity. The stack is presented as layers for models, harnesses, meta-harnesses, secure runtimes such as NVIDIA OpenShell, and inference infrastructure, with the runtime boundary established before launch so tools, plugins, MCP processes, and delegated runtimes operate under policy. It recommends least privilege, isolation, explicit authorization, auditability, short-lived and task-scoped access, independent checks, and safer failure states, while describing four security profiles from isolated to adversarial workloads. The conclusion is that every high-impact external effect must pass through enforcement layers the agent cannot bypass.

Takeaways

1. 1

   The harness owns the agent loop, context, tools, and session, making it a natural point for behavioral steering, but programmable harnesses cannot reliably guarantee security against their own modification.

2. 2

   A security boundary must be established before launch; tools, plugins, MCP processes, and model-directed code run inside the runtime, while subagents receive delegated child runtimes with ceilings they cannot exceed.

3. 3

   The four workload profiles—Isolated, Connected, Production, and Adversarial—apply progressively stronger controls such as restricted networks, short-lived identity, task-scoped access, human approval, quarantine, and default-deny communications.