{
  "abstract": "A first-person systems essay about model judgment, harness enforcement, external platform controls, and evidence and recovery as the real security boundary around coding agents.",
  "author": {
    "email": "tony@malott.ai",
    "email_url": "mailto:tony@malott.ai",
    "id": "person:tony-malott",
    "name": "Tony Malott",
    "resume_url": "https://malott.ai/resume/",
    "url": "https://malott.ai/"
  },
  "card": {
    "kicker": "Agent safety and system boundaries",
    "orientation": "A warning is useful. A denial is a boundary.",
    "visual_motif": "security-boundary"
  },
  "claims": [
    {
      "caveat": "No single source states the complete formulation verbatim; it is architecture judgment, not a universal theorem.",
      "id": "claim:126:system-property",
      "posture": "architectural-synthesis",
      "support": [
        "source:openai-codex-agent-loop",
        "source:owasp-llm06-excessive-agency"
      ],
      "text": "A coding agent's effective safety depends on the model plus its harness, tools, sandbox, network policy, identity, permissions, connected systems, approval design, independent platform controls, telemetry, and recovery model."
    },
    {
      "caveat": "Workspace and network restrictions vary by interface, platform, version, administrator policy, and user configuration; expanded or unsandboxed execution may be approved.",
      "id": "claim:126:sandbox",
      "posture": "source-confirmed-interface-qualified",
      "support": [
        "source:openai-gpt-5-3-codex-system-card",
        "source:openai-windows-sandbox"
      ],
      "text": "Current Codex cloud tasks run in isolated containers, and current local Codex interfaces use operating-system-enforced sandboxing by default."
    },
    {
      "caveat": "Network denial does not prevent unsafe local mutation, misuse of connected tools, exposure through approved destinations, or compromise through repository content.",
      "id": "claim:126:network",
      "posture": "source-confirmed-plus-inference",
      "support": [
        "source:openai-gpt-5-3-codex-system-card",
        "source:openai-running-codex-safely"
      ],
      "text": "Disabling or constraining outbound network access reduces prompt-injection exposure, data-exfiltration paths, and unintended contact with malicious resources."
    },
    {
      "caveat": "Vague or reflexively approved requests do not create meaningful governance.",
      "id": "claim:126:approvals-and-sandbox",
      "posture": "source-confirmed",
      "support": [
        "source:openai-running-codex-safely"
      ],
      "text": "The sandbox defines what the execution environment technically permits; approval policy determines when a reviewer must authorize an action that crosses or expands that boundary."
    },
    {
      "caveat": "This does not imply that every external integration is unsafe; each control model must be assessed independently.",
      "id": "claim:126:external-tools",
      "posture": "source-confirmed",
      "support": [
        "source:openai-codex-agent-loop"
      ],
      "text": "Codex shell containment does not automatically contain externally provided tools."
    },
    {
      "caveat": "Material damage depends on available tools, identity, permissions, validation, and independent controls.",
      "id": "claim:126:prompt-injection",
      "posture": "source-confirmed",
      "support": [
        "source:owasp-llm01-prompt-injection",
        "source:openai-gpt-5-3-codex-system-card"
      ],
      "text": "Direct or indirect prompt injection can redirect model behavior and may lead to unauthorized tool use, information disclosure, command execution, or manipulated decisions when the surrounding system grants sufficient agency."
    },
    {
      "caveat": "The taxonomy must be combined with identity, supply-chain, data, logging, recovery, and infrastructure security analysis.",
      "id": "claim:126:excessive-agency",
      "posture": "source-confirmed-plus-architectural-application",
      "support": [
        "source:owasp-llm06-excessive-agency"
      ],
      "text": "Excessive functionality, excessive permissions, and excessive autonomy create the conditions under which model error or manipulation can become damaging action."
    },
    {
      "caveat": "Applying zero-trust resource and least-privilege principles to agent identities is an architectural adaptation, not a NIST coding-agent implementation standard.",
      "id": "claim:126:least-privilege",
      "posture": "standards-grounded-architectural-inference",
      "support": [
        "source:nist-sp-800-207",
        "source:owasp-llm06-excessive-agency"
      ],
      "text": "The identity actually used by the agent or connected tool should receive only the resources, actions, duration, and environment required for the authorized task."
    },
    {
      "caveat": "This describes OpenAI's internal deployment, not an automatic guarantee for every Codex interface, plan, user, or organization.",
      "id": "claim:126:openai-internal-controls",
      "posture": "source-confirmed-scope-limited",
      "support": [
        "source:openai-running-codex-safely"
      ],
      "text": "OpenAI reports using managed sandbox modes, network policy, keyring-backed credentials, workspace-pinned authentication, managed configuration, and centralized agent-aware telemetry in its internal Codex deployment."
    },
    {
      "caveat": "The visible trace is evidence of externally manifested behavior, not a complete chain of thought or proof that nothing unobserved occurred.",
      "id": "claim:126:execution-trace",
      "posture": "source-confirmed-plus-owner-observation",
      "support": [
        "source:openai-codex-agent-loop",
        "source:openai-running-codex-safely"
      ],
      "text": "Tool requests, command results, file changes, approval decisions, network-policy outcomes, and final receipts can provide a useful operational account of agent behavior."
    },
    {
      "caveat": "This is lived operational evidence, not a universal product claim, controlled evaluation, or statistical result; no actual secret or attackable detail is disclosed.",
      "id": "claim:126:owner-observation",
      "posture": "direct-owner-observation",
      "support": [
        "source:shareplane-platform-issue-124",
        "source:shareplane-platform-issue-92-stop"
      ],
      "text": "Tony has repeatedly observed Codex flag unsafe credential exposure, recommend rotation, avoid carrying the secret forward, redact sensitive values, and stop at unresolved security or authority boundaries."
    },
    {
      "caveat": "Strong harness defaults and controls still materially reduce risk; they are necessary but not sufficient.",
      "id": "claim:126:strong-defaults",
      "posture": "architectural-conclusion",
      "support": [
        "source:owasp-llm06-excessive-agency",
        "source:openai-running-codex-safely"
      ],
      "text": "A strong coding harness cannot compensate for permanent broad credentials, unprotected production branches, unrestricted connectors, shared administrative identities, weak deployment gates, or absent recovery procedures."
    },
    {
      "caveat": "NIST guidance is voluntary and technology-neutral; it does not prescribe SharePlane's ticket-first, writer-lease, or exact-head workflow.",
      "id": "claim:126:lifecycle-governance",
      "posture": "source-confirmed-high-level",
      "support": [
        "source:nist-ai-rmf-1",
        "source:nist-ai-600-1"
      ],
      "text": "Roles, risk tolerances, testing, monitoring, incident handling, and human oversight should be maintained throughout the AI-system lifecycle."
    }
  ],
  "collections": [
    {
      "id": "collection:governed-ai-operations",
      "position": 6,
      "title": "Governed AI operations"
    }
  ],
  "dates": {
    "created": "2026-07-25",
    "updated": "2026-07-25"
  },
  "format": {
    "depth": "Standard long-form article",
    "interaction": "One editorial narrative with four structured teaching surfaces",
    "label": "Systems Essay",
    "reading_time": "16 min"
  },
  "id": "artifact:the-agent-is-not-the-security-boundary",
  "lifecycle": {
    "merge_authority": "not-granted",
    "owner_review": "required-at-exact-head-development-preview",
    "state": "PUBLISHED"
  },
  "presentation": {
    "motif": "security-boundary",
    "visual_blocks": [
      {
        "accessible_label": "The Boundary Test follows an agent request through model judgment, harness enforcement, external platform controls, and evidence and recovery.",
        "section_id": "the-model-is-only-one-layer",
        "type": "process-flow"
      },
      {
        "accessible_label": "Behavioral safeguards are compared with mechanical controls.",
        "section_id": "warning-versus-denial",
        "type": "comparison-panel"
      },
      {
        "accessible_label": "A public-safe receipt records an exact fail-closed authority stop.",
        "section_id": "a-successful-stop",
        "type": "responsive-ledger"
      },
      {
        "accessible_label": "Seven questions test read, change, identity, stop, authority, evidence, and recovery before writable access is granted.",
        "section_id": "the-seven-question-agent-safety-preflight",
        "type": "decision-matrix"
      }
    ]
  },
  "presentation_status": "candidate",
  "provenance": {
    "ai_assistance": {
      "role": "Exact source serialization, Platform-native rendering, deterministic validation, and protected Development UAT.",
      "used": true
    },
    "boundary": "Only owner-accepted public-safe article semantics, current public sources, and sanitized operational receipts are included. No real secret, private machine identity, credential locator, account identifier, or attackable configuration is exposed.",
    "posture": "Owner-originated first-person operating thesis with accepted semantics, a current bounded evidence ledger, and a selected Creative Lock under Issues #124 and #126.",
    "research_gap": "Tony's observed secret-handling behavior remains direct owner observation rather than a universal product claim or controlled evaluation. The article does not fabricate stronger evidence.",
    "sources": [
      {
        "description": "Issue-backed semantic authority; implementation does not reopen the accepted thesis.",
        "id": "source:shareplane-platform-issue-124",
        "locator": "https://github.com/pinklon/shareplane-platform/issues/124",
        "publiclyExposed": true,
        "role": "Governs the accepted semantics, claim postures, canonical article source, information design, and Creative Lock.",
        "title": "The Agent Is Not the Security Boundary",
        "type": "owner-accepted-semantic-authority"
      },
      {
        "description": "Implementation authority only; ready-for-review, merge, production, and writer release remain prohibited.",
        "id": "source:shareplane-platform-issue-126",
        "locator": "https://github.com/pinklon/shareplane-platform/issues/126",
        "publiclyExposed": true,
        "role": "Governs article-scoped implementation, exact-head Development preview, and the owner-UAT stop.",
        "title": "Implement The Agent Is Not the Security Boundary",
        "type": "bounded-implementation-authority"
      },
      {
        "description": "A direct operational receipt of successful stop-on-ambiguity behavior; it contains no credential-bearing detail.",
        "id": "source:shareplane-platform-issue-92-stop",
        "locator": "https://github.com/pinklon/shareplane-platform/issues/92#issuecomment-5064671946",
        "publiclyExposed": true,
        "role": "Demonstrates a public-safe stop before mutation when a required relationship identity was absent.",
        "title": "Fail-closed authority preflight receipt",
        "type": "direct-operational-receipt"
      },
      {
        "description": "OpenAI's internal deployment pattern is scope-limited and is not presented as a universal product default.",
        "id": "source:openai-running-codex-safely",
        "locator": "https://openai.com/index/running-codex-safely/",
        "publiclyExposed": true,
        "role": "Supports claims about complementary sandbox and approval controls, constrained network policy, credential storage, managed configuration, and agent-aware telemetry.",
        "title": "Running Codex safely at OpenAI",
        "type": "first-party-operational-guidance"
      },
      {
        "description": "The Codex shell sandbox does not automatically establish equivalent guardrails for externally provided tools.",
        "id": "source:openai-codex-agent-loop",
        "locator": "https://openai.com/index/unrolling-the-codex-agent-loop/",
        "publiclyExposed": true,
        "role": "Supports the harness, tool-loop, shell-permission, and external-tool boundary descriptions.",
        "title": "Unrolling the Codex agent loop",
        "type": "first-party-engineering-documentation"
      },
      {
        "description": "Exact behavior varies by interface, operating system, version, administrator policy, and configuration.",
        "id": "source:openai-gpt-5-3-codex-system-card",
        "locator": "https://deploymentsafety.openai.com/gpt-5-3-codex/introduction",
        "publiclyExposed": true,
        "role": "Supports current, interface-qualified descriptions of isolated cloud containers, local sandboxing, and network-risk mitigations.",
        "title": "GPT-5.3-Codex System Card",
        "type": "first-party-deployment-safety-documentation"
      },
      {
        "description": "A platform-specific engineering account, not a guarantee that every local configuration has identical containment.",
        "id": "source:openai-windows-sandbox",
        "locator": "https://openai.com/index/building-codex-windows-sandbox/",
        "publiclyExposed": true,
        "role": "Supports the interface-qualified description of operating-system-enforced local sandboxing.",
        "title": "Building a safe, effective sandbox to enable Codex on Windows",
        "type": "first-party-engineering-documentation"
      },
      {
        "description": "NIST SP 800-207 is not a coding-agent implementation standard; this is an explicitly labeled architectural application.",
        "id": "source:nist-sp-800-207",
        "locator": "https://www.nist.gov/publications/zero-trust-architecture",
        "publiclyExposed": true,
        "role": "Grounds the resource-centric, explicit-access, least-privilege identity adaptation.",
        "title": "Zero Trust Architecture, SP 800-207",
        "type": "authoritative-security-architecture-guidance"
      },
      {
        "description": "Voluntary, technology-neutral guidance; it does not prescribe SharePlane's ticket-first or exact-head workflow.",
        "id": "source:nist-ai-rmf-1",
        "locator": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10",
        "publiclyExposed": true,
        "role": "Supports continuous governance, testing, monitoring, incident handling, and human oversight across the lifecycle.",
        "title": "Artificial Intelligence Risk Management Framework 1.0",
        "type": "authoritative-risk-management-guidance"
      },
      {
        "description": "Supports high-level control principles without claiming a product-specific implementation guarantee.",
        "id": "source:nist-ai-600-1",
        "locator": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence",
        "publiclyExposed": true,
        "role": "Extends lifecycle risk-management guidance for generative-AI systems.",
        "title": "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile",
        "type": "authoritative-generative-ai-risk-guidance"
      },
      {
        "description": "Injection does not automatically cause material damage; the path depends on tools, identity, permissions, validation, and independent controls.",
        "id": "source:owasp-llm01-prompt-injection",
        "locator": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/",
        "publiclyExposed": true,
        "role": "Supports prompt injection as a first-class agent-system risk whose impact depends on available agency.",
        "title": "LLM01:2025 Prompt Injection",
        "type": "application-security-guidance"
      },
      {
        "description": "A useful taxonomy, not a complete threat model; identity, supply chain, data, evidence, and recovery remain necessary.",
        "id": "source:owasp-llm06-excessive-agency",
        "locator": "https://genai.owasp.org/llmrisk/llm062025-excessive-agency/",
        "publiclyExposed": true,
        "role": "Supports the excessive-functionality, excessive-permission, and excessive-autonomy framing.",
        "title": "LLM06:2025 Excessive Agency",
        "type": "application-security-guidance"
      },
      {
        "description": "Related semantic lane; it is not implementation authority for this artifact.",
        "id": "source:shareplane-platform-issue-18",
        "locator": "https://github.com/pinklon/shareplane-platform/issues/18",
        "publiclyExposed": true,
        "role": "Related work on evidence, learning, and the operating state left behind by an agent worker.",
        "title": "The Agent Worker Should Leave the System Smarter",
        "type": "related-work-authority"
      },
      {
        "description": "Related delivery-method lane; it is not implementation authority for this artifact.",
        "id": "source:shareplane-platform-issue-116",
        "locator": "https://github.com/pinklon/shareplane-platform/issues/116",
        "publiclyExposed": true,
        "role": "Related work on proving a bounded operating path before optimizing its machinery.",
        "title": "Build the Path Before You Optimize the Machine",
        "type": "related-work-authority"
      }
    ]
  },
  "public": true,
  "public_safe_status": "accepted",
  "relationships": [
    {
      "label": "Authored by Tony Malott",
      "target_id": "person:tony-malott",
      "type": "authored_by"
    },
    {
      "label": "Semantic and Creative Lock authority: Issue #124",
      "target_id": "issue:shareplane-platform:124",
      "type": "governed_by"
    },
    {
      "label": "Development implementation authority: Issue #126",
      "target_id": "issue:shareplane-platform:126",
      "type": "implemented_by"
    },
    {
      "explanation": "Continue from the security boundary into the control-plane architecture that governs work around the agent.",
      "label": "Companion: The Agent Is Not the Product",
      "reader_group": "foundations",
      "target_id": "artifact:the-agent-is-not-the-product-the-control-plane-is",
      "type": "companion"
    },
    {
      "explanation": "Connect bounded agent authority to the operating discipline required when orchestration, evidence, and integration become the real constraints.",
      "label": "Companion: The Agents Were Never the Bottleneck",
      "reader_group": "counterpoints",
      "target_id": "artifact:the-agents-were-never-the-bottleneck",
      "type": "companion"
    },
    {
      "label": "Related: The Agent Worker Should Leave the System Smarter",
      "target_id": "issue:shareplane-platform:18",
      "type": "semantic-boundary"
    },
    {
      "label": "Related: Build the Path Before You Optimize the Machine",
      "target_id": "issue:shareplane-platform:116",
      "type": "semantic-boundary"
    }
  ],
  "schema_version": "2.0.0",
  "semantic_status": "locked",
  "slug": "the-agent-is-not-the-security-boundary",
  "source": {
    "content_status": "canonical-full",
    "format": "markdown",
    "path": "content/artifacts/the-agent-is-not-the-security-boundary/source.md"
  },
  "subtitle": "What months of watching Codex taught me about letting agents work without handing them the keys",
  "thesis": "Do not ask whether the agent is trustworthy. Ask whether the system remains safe when the agent is wrong.",
  "title": "The Agent Is Not the Security Boundary",
  "topics": [
    "agentic-systems",
    "security-boundaries",
    "sandboxing",
    "least-privilege",
    "evidence-recovery"
  ],
  "type": "systems-essay"
}