Threat model

This page summarizes what Agent Guard protects against and where the limits are. A full threat register with STRIDE category analysis lives in the Agent Guard repository at docs/security/threat-model.md. The summary here is what most users need to make sensible deployment decisions.

What Agent Guard protects

The agent process is the threat. Either it is acting autonomously and reaches for something it should not, or it has been manipulated by a prompt injection into trying to exfiltrate data, install something malicious, or run a destructive command. Either way, Agent Guard's job is to make sure the protections do not depend on the agent behaving correctly.

What Agent Guard protects:

• Host filesystem outside the workspace. The agent runs in a different operating system and can only see what was explicitly mounted.
• Host credentials. The agent has no access to your Keychain, ~/.ssh/, ~/.aws/, shell history, or any other credential store unless you explicitly pass it with --pass-env or --pass-cloud-creds. Passed credentials travel over vsock to tmpfs inside the microVM and are discarded when the microVM exits.
• Internal network services that should not be reachable by the agent. ArtifactPolicy controls which registries the agent can pull from. ToolPolicy controls what shell commands and HTTP requests the agent can issue. The microVM itself is also a network boundary.
• The integrity of policy rules. Policies live in a path the agent cannot write to inside the microVM. The gateway loads them at startup and the agent has no way to modify them at runtime.
• The audit log. Every policy decision is written to a host-side log at ~/Library/Logs/AgentGuard/policy_audit.jsonl. The agent cannot reach that file from inside the microVM.

Trust assumptions

For the threat model to hold, four things must be true.

• The host kernel and OS are not compromised before Agent Guard is installed. If the host is already compromised, Agent Guard provides no additional defense and an attacker likely controls the protections.
• The developer running Agent Guard is trusted. Agent Guard defends against the agent process misbehaving. It does not defend against a malicious developer using the same machine.
• The Apple Virtualization.framework hypervisor is trusted. It is Apple-signed and hardware-enforced. Bugs at this layer are out of scope for Agent Guard.
• Codesigning and SIP are enabled on the host. Agent Guard binaries are codesigned with hypervisor and virtualization entitlements. Disabling SIP or removing entitlements breaks the protections.

What Agent Guard does not protect against

A non-exhaustive list of things outside Agent Guard's scope.

• Prompt injection itself. Agent Guard limits the damage when injection succeeds, because every tool call still goes through policy. It does not guarantee detection of the injection in the agent's reasoning.
• Network intrusion detection. Agent Guard does not inspect inbound network traffic for attack signatures. Pair with a NIDS if you need that.
• Agent output quality. Drift, hallucination, low-quality completions, model degradation. Agent Guard does not measure or alert on these.
• Static code analysis. Agent Guard does not analyze the code the agent writes. Pair with the code scanning tool you already use.
• Inter-agent transport security. No mTLS, no agent-to-agent authentication. Layer those at the network if you need them.
• Bugs in the policies themselves. A policy that allows what it should block is a policy bug. Test policies before deploying them.

Where the boundary is

The agent runs in a different operating system, so most failure modes of OS-level enforcement do not apply. The boundary is the hypervisor. If a policy rule has a bug or the gateway is somehow bypassed, the worst case is the agent still running inside an isolated microVM with only the workspace mounted and nothing else of the host's reachable.

Reporting issues

If you find a way to bypass Agent Guard's protections, report it at https://github.com/jozu-ai/agentguard/security/advisories/new rather than opening a public issue.