Designing Boundaries: Zero Trust and Containment for People, Agents and Machines

All courses / The Transformed Security Architect / Module 2 / Chapter 7

Learning objectives

After the lesson the participant can:

• State the four properties of a boundary and explain why a system prompt has none of them.
• Review a boundary for correlated controls, treating every service that relays for its clients as an egress path.
• Design a containment profile for an agent using the six questions, with a checkable blast radius statement.
• Specify tests that show a boundary holds from a position the contained party cannot influence.

Key concepts

Four properties of a boundary

A boundary is enforced outside the party it governs, states a ceiling on consequences instead of a hope about behaviour, is an artefact with an owner, a version history and a test, and can be shown to hold without the cooperation of what it contains.

Policy decision point outside the model

Deterministic code between model and tool servers that evaluates every tool request against a versioned permission manifest. It decides on structured facts such as tool, arguments, identity and target, never by a classifier judging whether output looks harmful.

Correlated controls

Controls that share a dependency, such as a credential, a shared service or the administrative plane, so that one failure defeats two or more. The chapter treats a correlated control failure as a design defect the architect can look for.

Blast radius

The largest harm an actor can cause with the permissions it holds before it is stopped, determined by reach, rate, duration, reversibility and spread. The weakest dimension sets the radius, and the architect writes it as a statement a reviewer can check.

Containment profile and permission manifest

The manifest is the agent's declared intent: purpose, identity, tools, constraints, approvals and budgets. The profile is the platform's commitment whatever the agent attempts. The profile must be at least as strict as the manifest and must not depend on the manifest being obeyed.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. A stop instruction sent to an agent is merely a request the agent processes. What in your estate is currently called a stop path but would not act if the system did not cooperate?
2. Nordvik must verify by evidence what it buys, and Hansa what it builds. What can a tender annex with verification rights achieve that a supplier questionnaire cannot?
3. The chapter says to fix a shared dependency instead of adding a compensating control. When is that advice hard to follow, and what should the decision record then say?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. What does the chapter mean by extending zero trust to agents?

   1. Granting agents the same network location trust as managed devices
   2. Asking a classifier to judge whether each output looks harmful
   3. Verifying the action as well as the actor, at a policy decision point outside the model
   4. Requiring agents to confirm in their instructions, before every tool call, that they will stay within scope
   Show the answer

   C. Verifying the action as well as the actor, at a policy decision point outside the model
   For an agent the identity is genuine and the permissions legitimate, but the sequence of actions is chosen at run time by a model reading content anybody may have written. Zero trust therefore verifies the action as well as the actor.

2. What did the review recorded as AIDR-0552 change in the containment of Hansa's IT-operations agent?

   1. It raised the write budget from four to twenty actions per incident
   2. It restricted the shared artefact mirror to a signed allow-list and removed it from the agent's destinations
   3. It moved the stop decision from the on-call engineer to the review board
   4. It replaced the weekly egress probe from outside the agent's network with a quarterly attestation by the profile's owner
   Show the answer

   B. It restricted the shared artefact mirror to a signed allow-list and removed it from the agent's destinations
   Before the review the shared mirror in Frankfurt could fetch from public hubs on request, so any workload that reached it could reach those hubs. Hansa restricted the mirror to a signed allow-list of upstream namespaces and removed it from the agent's destinations.

3. According to the chapter, what happens to a control's classification when its boundary test fails or becomes overdue?

   1. It stays verified until the owner confirms the finding in writing
   2. It is removed from the catalogue until the next audit
   3. It is marked amber and reported to the design authority
   4. It moves from verified to declared automatically
   Show the answer

   D. It moves from verified to declared automatically
   The test cadence follows the change cadence of the dependencies, and a failed or overdue test moves the control from verified to declared automatically, because a boundary that has not recently been tested is a declaration.