1. Core Security Invariants
Boundrix enforces five foundational security invariants across all agentic workflows:
1. **Zero Standing Privilege**: Agents hold zero permanent, unrestricted enterprise tokens or admin privileges.
2. **Task-Bound Delegation**: Authority is granted solely through short-lived, immutable scope receipts.
3. **Per-Call Admissibility**: Authorizations are never cached across distinct execution boundaries.
4. **Fail-Closed Design**: Any error, expiration, network partition, or revocation strictly defaults to `DENY`.
5. **Immutable Evidence**: Every decision generates an auditable, non-repudiable `AuditRecord`.
2. Threat Mitigation Matrix
| Threat Vector | Attack Scenario | Boundrix Mitigation |
|---|---|---|
| **Scope Creep** | AI Agent authorized to read a repository attempts to delete branches or deploy to production. | **Action Namespace & Scope Validation**: Only actions in `task.allowed_actions` and resources strictly matching `task.scope.repo` / `task.scope.branch` evaluate to `ALLOW`. |
| **Stale Authority & Replay** | An agent attempts to reuse a previous approval after task expiration. | **Live UTC Clock Validation**: The policy engine evaluates `now() > task.expires_at` in real time. |
| **Agent / Task Hijacking** | Malicious agent attempts to execute actions under another agent's task. | **Identity Ownership Pinning**: Engine verifies `task.agent_id == agent.agent_id` before evaluating permissions. |
| **Post-Revocation Execution** | Agent attempts to complete downstream tasks after security administrator revokes access. | **Instant State Lookup**: Real-time validation of `agent.status == ACTIVE` and `task.status == ACTIVE` immediately blocks subsequent calls. |
| **Audit Log Tampering** | Attacker attempts to modify past decisions to cover unauthorized actions. | **Frozen Data Models**: `AuditRecord` enforces immutability and append-only persistence. |
3. Sequential Policy Pipeline
The policy engine executes sequential, fail-closed checks in strict order:
1. agent.status == AgentStatus.ACTIVE (Else DENY: "Agent is revoked")
2. task.agent_id == agent.agent_id (Else DENY: "Task does not belong to this agent")
3. task.status == TaskStatus.ACTIVE (Else DENY: "Task is not active")
4. now() <= task.expires_at (Else DENY: "Task has expired")
5. action in task.allowed_actions (Else DENY: "Action not permitted for this task")
6. resource matches task.scope (Else DENY: "Resource outside task scope")
7. ALL CHECKS PASS ➔ ALLOW ("Action within task scope and not expired")4. Anti-Bypass Guarantees & Enforcement Boundaries
How Boundrix prevents agents from bypassing authorization to reach targets directly:
• **SDK-Only Mode**: Agent calls `authorize()` before tool execution. The customer is responsible for ensuring the runtime cannot execute unbrokered network requests.
• **Sidecar / Tool-Gateway Mode**: The agent is network-isolated and cannot reach target APIs directly. All outbound traffic routes through the Boundrix sidecar, which forwards only `ALLOW` actions.
• **Credential-Broker Mode**: The agent never receives downstream API credentials (e.g. GitHub PATs). Narrowly scoped credentials are only minted or injected post-authorization by the gateway.
**Design Principle**: Bypass prevention is guaranteed at the network and cryptographic credential boundaries, not purely through client-side code conventions.