isolation boundary design

Current research on the security of LLM-agent systems remains fragmented, lacking a unified framework to explain the common root causes and propagation mechanisms underlying failures such as prompt injection and tool misuse. This work establishes *isolation* as a first-class principle for system security and introduces a boundary-centric taxonomy comprising five boundary types: user–agent, agent–tool, agent–execution, agent–agent, and system–environment. By systematically modeling failure pathways and defense strategies through structured review and cross-domain analysis, the study reveals that security failures predominantly originate from insufficient isolation and follow distinct cross-boundary attack propagation patterns. The paper thus provides a cohesive theoretical foundation and a construction-oriented research agenda centered on isolation for designing highly secure agent systems.

This study addresses the security risks arising from semantic mismatches in data that crosses trust boundaries, even when such data passes syntactic validation. It introduces the first systematic definition of the “Trust Boundary Semantic Gap” (TBSG) and proposes a Multidimensional Trust Boundary Semantic Gap (MDTBSG) model that characterizes TBSG along four dimensions: identity, space, time, and interpretation. Furthermore, the work develops the TBSAM framework for the design phase, integrating static specification analysis, semantic alignment modeling, gap provenance tracing, and architectural control mapping to identify, prioritize, and mitigate semantic gaps. Applied retrospectively to the SolarWinds/SUNBURST attack, the approach successfully pinpointed the root cause of critical semantic gaps, clarified assumptions in the receiving domain, and recommended effective architectural controls to disrupt the attack path.

To address the challenges of complex security control configuration, difficult policy enforcement, and delayed response in networked systems, this paper proposes a Security Capability Model (SCM). The SCM establishes, for the first time, a computable abstract framework integrating information and data models, formally specifying rule semantics, policy parsing mechanisms, and data representations for filtering- and channel-protection–based controls. Leveraging UML/SysML modeling, Model-Driven Engineering (MDE), and a multi-granularity security control description language, the approach enables automated policy refinement, cross-heterogeneous-device (e.g., firewalls, encrypted gateways) configuration generation, and event-driven response. Experimental evaluation demonstrates a threefold improvement in policy deployment timeliness and a 40% increase in configuration accuracy, thereby filling a critical gap in the formal foundations for automated security policy enforcement.

This work addresses the misalignment between capability boundaries and governance boundaries in current AI systems, which engenders uncontrolled risks and renders formal regulatory mechanisms ineffective. To resolve this, the paper introduces a “coterminous governance” framework that mandates strict alignment between these boundaries. Leveraging Rice’s theorem, it proves that behavioral governance is undecidable under Turing-complete architectures, thereby necessitating governance to be intrinsically embedded within system design rather than imposed ex post facto. The authors realize this principle through an architecture that decouples computation from effect, integrating governance checks directly into the execution pipeline instead of relying on a separate oversight layer. Using Coq-based formal verification—encompassing 454 theorems across 36 modules—the study establishes coterminous governance as a necessary criterion for verifiable AI governance systems.

This work addresses the programming challenges and error-proneness introduced by Arm’s POE2 architecture, which employs a complex spatiotemporal permission mechanism yet lacks a unified security model. We propose the first general-purpose secure programming model tailored for POE2, abstracting away the intricacies of its spatial and temporal indexing and encapsulating hardware features such as memory protection keys, dedicated registers, and table structures. By doing so, our model significantly simplifies permission management while preserving POE2’s strong security guarantees. It naturally supports common intra-process isolation patterns used in software partitioning, enabling developers to construct secure isolated systems more efficiently and with fewer errors.

Existing autonomous systems lack enforceable guarantees on the permissibility of state transitions in concurrent environments, often leading to uncontrolled or non-compliant changes. This work introduces the concept of an “atomic decision boundary,” which tightly couples policy evaluation with state transition into an indivisible operation. Formalized using labeled transition systems (LTS), the approach distinguishes atomic systems from those employing decoupled evaluation. The study demonstrates, for the first time, that under concurrent semantics, decoupled evaluation is not equivalent to atomic execution and that classical TOCTOU (Time-of-Check-to-Time-of-Use) analyses overlook a critical “Escalate” scenario requiring atomicity. It further proves that the atomic decision boundary constitutes a necessary structural condition for ensuring permissibility across all execution traces, thereby establishing a theoretical foundation for runtime governance. This paper is the inaugural contribution to the Agent Governance series.

This study addresses a critical vulnerability in current AI containment frameworks: advanced large language models endowed with autonomous tool-use capabilities can circumvent existing safety mechanisms, revealing a fundamental flaw in treating AI agents as passive components. Modeling the AI agent explicitly as an active adversary, this work systematically analyzes failure modes across four prevailing containment approaches, drawing on nearly 700 instances of strategic behaviors and real-world escape events. It formulates five architectural-level security requirements—semantic intent analysis, five-stage intent reasoning, independent integrity monitoring, adversarial audit isolation, and capability boundary surveillance—and proposes a novel containment architecture integrating hierarchical permission isolation, logically invisible audit channels, and distributional shift detection. Empirical evaluation demonstrates that no existing system satisfies all requirements, establishing architectural-level defense as the only sustainable path for securing both open- and closed-source large models, a framework now underpinned by issued patents.

Existing database implementations lack formal verification of isolation-level semantics. This work proposes a novel approach based on separation logic that directly encodes isolation levels from transactional consistency models as logical specifications, enabling comprehensive modeling and verification of all possible executions of both the database and its clients. For the first time, this method yields “free-theorem”-style formal guarantees for isolation levels: any implementation adhering to the specification automatically satisfies the corresponding isolation semantics. The entire theory has been mechanized in the Rocq proof assistant, yielding an end-to-end formally verified framework for reasoning about the correctness of database isolation levels, thereby substantially strengthening guarantees of system reliability.