FIG. 1 — ZERO TRUST ENFORCEMENT PER AGENT ACTION
MODEL
PLANNER
holds no secrets
TRUST BOUNDARY
REQUEST
EXECUTION LAYER
— the infrastructure, not the model, decides how each action runs
1
SCOPED
IDENTITY
per agent & task
2
TOOL
ALLOWLIST
granted tools only
3
CREDENTIAL
ISOLATION
kept from the model
4
SANDBOXED
EXECUTION
isolated · no net/fs
5
EGRESS
GATE
outbound by host
ALLOWED
SYSTEMS
& HOSTS
CRM · APIs · hosts
6
AUDIT LOG
every action recorded — readable, replayable, exportable
APPEND-ONLY