Abstract
Protected Execution Finality for Sandboxed AI Agents: Credential Mediation, Process-Lineage Control and Network-Egress Enforcement
PATENT BASIS This document is based on international patent application PCT/IB2026/055615 (the "Mothership" application), filed on 4 June 2026 and publicly disclosed on 16 July 2026, which claims priority from PCT/IB2026/053385 (the ALF application), filed on 7 April 2026 and publicly disclosed on 4 June 2026.
This informational document describes future-oriented executionfinality profiles for sandboxed autonomous AI agents, protected host services, credential brokers, external connectors, process-lineage restrictions, proxy-mediated network egress, native resources, and downstream effectuation interfaces. It examines sandbox versus authority separation, protected credential use, destination binding after DNS resolution, operation-specific validation, influence tracking, bypass-path completeness, replay restrictions, recovery and independent sink verification. It distinguishes possession of sandbox or proxy permissions from authority for a particular actual resource effect. Source-derived procedures, tests and algorithms are presented as implementation examples, not as evidence that identified vendors implement this proposed architecture. Industry Relevance: Recent public developments in autonomous AI-agent security and execution governance include Microsoft Execution Containers (MXC), Microsoft Agent Governance Toolkit ADR-0030 (Action-Bound, Fail-Closed Approval Protocol), and Project Perception; Google Agent Gateway and Gemini Agent; Meta Muse/Sentinel AI-Agent Security Architecture; NVIDIA OpenShell Reference Architecture and NVIDIA Sentry; OpenAI Agents API, Codex, Agents SDK, and Responses API; and Anthropic Claude Managed Agents, Claude Code Sandboxing, and Claude Code Auto Mode. These initiatives illustrate industry attention to agent isolation, independent policy enforcement, action-bound authorization, delegated authority, credential isolation, network-egress security, hardware-assisted containment, runtime supervision, and fail-closed controls. This draft describes related proposed execution-finality mechanisms without asserting that these initiatives implement them. Relevance to the IETF: the mechanisms described here require common, interoperable objects and verification semantics across independently built components, including operation descriptors, act-bound nonbearer capabilities, finality-sink verification results, validation evidence, and authority, revocation, and containment generations. The document relates to existing IETF work on OAuth, GNAP, RATS, WIMSE, ¶ ¶ and SCITT, and asks the community whether and where this effectuation-boundary problem should be addressed. This document is intentionally long and is not repetitive: each profile specifies a distinct mechanism with its own algorithms, failure cases, and enforcement points, and the security properties depend on how these mechanisms combine. A reduced excerpt would hide the conditions under which they fail closed, so this document and its two companion drafts, among which the profiles are divided, are meant to be evaluated as a whole. This draft builds on earlier Internet-Drafts by the same author, in particular draft-das-agent-execution-finality, and adds mechanism families not described there; the Introduction states precisely what was disclosed earlier and what is disclosed here. IPR: The technical content of this draft set is based upon the author's international application PCT/IB2026/055615, which forms the foundation of this disclosure and comprises approximately 300 distinct, non-repetitive embodiments and enforcement points. A separate patent application specific to the material in this draft set has also been filed. Related Indian applications: 202531130665, 202631000572, 202631001586, 202631002990, 202631124028, and 202631125689. Related international applications: PCT/IB2025/058316, PCT/IB2026/053385, PCT/IB2026/055615, PCT/IB2026/055760, PCT/ IB2026/055870, PCT/IB2026/056058, PCT/IB2026/056809, and PCT/ IB2026/056941. These identify related technical disclosures; not all described mechanisms are necessarily patent-claimed or granted, and patent scope and priority depend on applicable law and examination
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License
Recommended Citation
Das, Sangam Kumar, "Inside the Sandbox Is Not Permission: Stopping AI Agents From Acting Through Borrowed Credentials, Child Processes and Unchecked Network Paths", Technical Disclosure Commons, (November 05, 2026)
https://www.tdcommons.org/dpubs_series/12773