Abstract
Abstract
This record concerns a security architecture for autonomous AI agents disclosed in two foundational international patent applications under the Patent Cooperation Treaty. PCT/IB2026/053385, filed on 7 April 2026, was published by the World Intellectual Property Organization on 4 June 2026 as WO2026115520. PCT/IB2026/055615, the 8,598-page foundational specification, was filed on 4 June 2026 and published on 16 June 2026 as WO2026150382. Both claim priority from December 2025 through 32 Indian provisional patent applications and are followed by ten further PCT applications.
The invention separates what an AI agent can propose from what it can make happen. The agent, such as a large language model (LLM) agent, coding agent, or tool-using assistant, runs inside an isolated agent runtime (sandbox, container, runtime cell, virtual machine, or restricted execution environment) and holds no real credentials, API keys, OAuth tokens, or direct network authority. In place of a real credential, the agent holds only a non-authoritative reference handle; possession of that handle does not by itself authorize any action, and the real credential and authorization state remain on the host side outside the agent’s control.
Every consequential operation the agent generates, including outbound HTTP and API requests, network connections, credential requests, tool calls, MCP tool invocations, connector actions, file writes, and data output, is intercepted before leaving the sandbox and held as a pending request with no external effect. Enforcement uses a dual enforcement gate. At the first gate, a protected policy decision component outside the agent evaluates the specific request against a protected authorization scope covering permitted purposes, operations, destinations, time windows, quotas, and data constraints. At the second gate, a host-side policy enforcement point at the actual egress or execution boundary, such as a network egress proxy, forward proxy, API gateway, credential broker, tool execution proxy, kernel broker, container runtime hook, eBPF or seccomp filter, or SmartNIC/DPU, allows the operation only if it carries a valid, narrowly scoped, single-use capability bound to that exact request. Credential granting, packet transmission, and API invocation occur only on the host side, after verification. A continuous-stream variant requires fresh validation for each successive command, API call, network request, or file operation instead of blanket standing permission. Requests that fail validation, are modified after approval, are replayed, or cannot be verified are blocked by default (fail-closed). Data provenance and taint labels can travel with each request and be checked at both gates to prevent data exfiltration and limit prompt-injection impact.
The record invites technical, patent, and security reviewers to compare this earlier disclosure, in particular Embodiment 85.B2 (agent sandbox egress gate) and Embodiment 84 of PCT/IB2026/055615, with Meta’s Muse/Sentinel agent security architecture publicly described on 8 September 2026, and to determine independently which functions were expressly disclosed earlier, which correspond functionally, and which are implementation-specific engineering choices. No copying or infringement is alleged; independent development remains possible.
International Application No. PCT/IB2026/053385, filed 7 April 2026, published 4 June 2026 as WO2026115520 WIPO publication: https://patentscope.wipo.int/search/en/detail.jsf?docId=WO2026115520
International Application No. PCT/IB2026/055615 (foundational specification, 8,598 pages), filed 4 June 2026, published 16 June 2026 as WO2026150382 WIPO publication: https://patentscope.wipo.int/search/en/detail.jsf?docId=WO2026150382
Zenodo record: https://zenodo.org/records/23255613
Keywords: AI agent security; LLM agent sandbox; agentic AI runtime isolation; agent runtime cell; sandboxed agent execution; dual enforcement gate; two-stage authorization; outbound request authorization; agent egress control; egress filtering; network egress proxy; forward proxy; Layer 7 request inspection; API gateway; credential broker; credential daemon; host-side credential store; credential isolation from agent; credential vaulting; credential placeholder; surrogate credential; real credential withheld from sandbox; host-side credential granting; OAuth token protection; API key protection; non-bearer token; single-use capability token; scoped capability; per-request authorization; fresh authorization per request; policy enforcement point; policy decision point; reference monitor; host-side enforcement; privileged connector; connector authorization; tool call authorization; MCP tool security; container runtime hook; kernel broker; eBPF; seccomp; Linux Security Module; LSM; SmartNIC; DPU; data provenance; taint tracking; taint propagation; data exfiltration prevention; prompt injection mitigation; fail-closed enforcement; replay protection; zero-trust AI agent architecture
IPC: G06F 21/53; G06F 21/54; G06F 21/62; G06F 9/455; H04L 9/40; H04L 9/32; G06N 20/00
CPC: G06F 21/53 (execution in restricted environment, e.g. sandbox); G06F 21/54 (security routines added to programs, e.g. taint tracking); G06F 21/6218 (protecting access to data or resources via access control); G06F 21/604 (access control policy tools); G06F 9/45558 (hypervisor and container management); H04L 63/0281 (proxies); H04L 63/10 (controlling access to network resources); H04L 63/0807 (authentication using tickets or tokens); H04L 63/20 (network security policies); H04L 9/3213 (authentication using tickets or tokens); G06N 20/00 (machine learning)
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License
Recommended Citation
Das, Sangam Kumar, "Agent Proposes, Boundary Decides: An Open Reviewer Question on Prior Disclosure of Externalized Execution Authority in AI Agent Security Architectures", Technical Disclosure Commons, ()
https://www.tdcommons.org/dpubs_series/12542