information flow control

Traditional enterprise security models, reliant on static perimeters, struggle to address the dynamic risks introduced by production-grade AI agents operating within authorized workflows. This work proposes the first five-plane reference architecture for runtime governance of AI agents—spanning inference, network, identity, endpoint, and data—and introduces core primitives including arbitrary-point interception, composite subjects with capability decay, and structured audit evidence. By extending policy enforcement from atomic subjects to decay-aware composite subjects, the framework defines six interruption primitives and four correctness invariants. Evaluated across five real-world workflows, it successfully mitigates seven threat classes, achieves microsecond-scale policy decisions, and validates correctness of capability decay, audit reconstructability, and tamper resistance, thereby filling a critical gap in dynamic governance for agent-driven workflows.

This work addresses the semantic gap faced by current AI agents in enforcing natural language policies: the intended policy semantics are difficult to enforce precisely and interpretably at the system level. To bridge this gap, the authors propose a novel approach that integrates agent-side context with kernel-level enforcement mechanisms. For the first time, policy context is preserved on the agent side, while a domain-specific language (DSL) for information flow control (IFC), implemented via eBPF, enables comprehensive, action-level policy enforcement within the operating system kernel. This framework supports cross-event data-flow and ordering constraints, significantly improving policy compliance rates by covering indirect execution paths invisible to conventional tool-call interception. The system incurs only 1.9%–8.4% runtime overhead and provides semantically clear feedback instead of ambiguous errors.

This work addresses the lack of comprehensive governance mechanisms—such as permissions, prohibitions, obligations, exemptions, and policy conflict resolution—in existing autonomous agent systems for cross-organizational collaboration. To bridge this gap, the authors propose AgenticRei, a novel framework that, for the first time, integrates obligation lifecycle management, context-aware exemptions, and policy conflict resolution within a unified runtime governance architecture. The framework formalizes deontic policies using an OWL ontology and leverages the Rei policy language coupled with a high-performance logical reasoning engine to enable dynamic policy inference. AgenticRei seamlessly aligns with industry standards like A2AS and successfully enforces security and privacy constraints that current production-grade policy engines struggle to handle, thereby significantly enhancing both the expressiveness and practical feasibility of agent governance in complex, real-world scenarios.

This work addresses the vulnerability of AI agents to malicious inputs or internal errors, which can lead to unauthorized actions and hallucination-induced errors that compromise system security. To mitigate these risks, the paper proposes AgentGuardian, a context-aware adaptive access control framework that monitors agent execution traces to learn legitimate behavioral and input patterns. By integrating real-time input context with control-flow dependencies across multi-step tool invocations, AgentGuardian dynamically constrains agent operations. This approach uniquely combines control-flow analysis with behavioral modeling to effectively defend against agent misuse. Experimental evaluation on two real-world AI agent applications demonstrates that AgentGuardian efficiently detects malicious or misleading inputs, significantly reducing orchestration errors caused by hallucinations while preserving normal functionality.

This work addresses the prevalent issue of over-privileged access control policies that violate the principle of least privilege, often leading to security misconfigurations. To mitigate this, the authors propose a novel method that automatically refines policy rules by analyzing historical access logs and rewriting permission rules in the Amazon Cedar policy language. The approach ensures that system functionality remains unchanged while significantly tightening granted permissions. This study presents the first automated realization of the least privilege principle in practice, demonstrating its effectiveness in two real-world scenarios: it substantially reduces the scope of permitted access, thereby enhancing security, without disrupting normal system operations.

This work addresses the lack of context-aware, verifiable governance mechanisms in existing AI agents, which hinders dynamic assessment of the legitimacy of authorized actions. The paper proposes AgentBound, a runtime governance framework that leverages a tripartite authority structure—comprising delegated authorization, owner-signed behavioral charters, and site-specific action contracts—to conservatively evaluate each action through a formal decision model, yielding deterministic allow, review, or deny outcomes. It introduces verifiable governance receipts and a continuous delegation model, enabling cryptographic binding of decisions, independent replayable verification, and dynamic permission updates. Evaluation on the AgentBound-Bench benchmark demonstrates the system’s effectiveness in ensuring governance correctness, enforcing compositional authority logic, and supporting accountability, thereby providing AI agents with a deterministically governed, independently verifiable layer of oversight.

Enterprise-grade autonomous agents struggle to reliably handle security-critical metadata—such as access policies and data classifications—due to hallucinations, misinterpretations, or adversarial attacks, thereby introducing systemic risks. This work proposes Redpanda Autonomous Data Plane (ADP), which pioneers a paradigm shift by completely removing security metadata from the agent’s operational path. ADP enforces policy compliance and tamper-proof auditing through infrastructure-level out-of-band channels that transmit security context, policy signals, and audit logs invisibly and non-bypassably. Evaluated in a multi-agent portfolio rebalancing system, ADP successfully ensured strict customer data isolation, enforced transaction approval thresholds, and maintained comprehensive auditability, demonstrating its efficacy and robustness in real-world deployments.

This study addresses the governance vacuum in decentralized AI systems, where the absence of a clear locus of accountability renders traditional regulatory frameworks ineffective, resulting in dual deficits in both accountability and intervention. Building on Lessig’s modalities of regulation and Searle’s theory of rules, the paper develops an analytical framework centered on architectural constraints. It innovatively proposes a “protocol governance” paradigm that shifts the focus of governance from policy to protocol, integrating democratic authorization and ethical constraints through constitutive rules. The authors further articulate four essential ethical conditions—legitimacy, contestability, transparency, and non-domination—that such protocols must satisfy. This approach offers a viable and principled pathway for governing decentralized AI systems.

Traditional operating systems struggle to support goal-directed, dynamically tool-invoking agents with adaptive behaviors, exhibiting fundamental limitations in scheduling, state management, security, and observability. This work presents the first systematic design of an Agent Operating System (AOS) architecture, which introduces an agent control plane into conventional OS abstractions and rethinks core mechanisms—including scheduling, context management, capability registration, policy enforcement, and auditing. AOS clearly delineates responsibility boundaries and non-goals, establishing a multi-layered integration model spanning user-space runtimes to distributed control planes, thereby transcending the traditional OS assumption of deterministic program execution. The paper establishes novel system abstractions for agent-centric computing, proposes a security threat model and evaluation criteria, and makes significant advances in ensuring deterministic execution, auditability, and operational interpretability.

This work addresses the security and compliance risks arising when large language model (LLM) agents directly trigger state-changing actions within workflows. To mitigate these risks, the authors propose decoupling action generation from execution and introduce, for the first time, an Organizational Control Layer (OCL) architecture—a model-agnostic, non-intrusive governance infrastructure that enforces policy checks, enables action interception, and supports human escalation prior to execution. The approach requires no modification to the underlying LLM and is compatible with diverse backend systems. Evaluated on an adversarial negotiation task, the method reduces unsafe execution rates from 88% to near zero while increasing effective success rates from 12% to 96%, demonstrating the efficacy and practicality of the proposed governance mechanism.