Threats and control boundaries
Threat scenarios for agent skills, tools and connected services.
INDEPENDENT SECURITY RESOURCE
Review the skill. Constrain the authority.
A working guide to the permissions, provenance and runtime controls behind AI agent skills, MCP servers and connected tools.
Open the reviewA proposed control boundary
Authority follows policy.
01 / ADMISSIONPublisher + version + intent
02 / EXECUTIONIdentity + scope + isolation
03 / OVERSIGHTEvidence + revocation
Conceptual architecture. This website does not inspect, block or execute your agent tools.
Review a skillA useful starting point
A skill is a
permission decision.
Instructions, scripts and connected services can turn a language model’s output into action. Review the full capability, the data it can reach, and the systems that enforce its limits.
Read the field guideInside the guide
A proposed admission and runtime architecture
A reference workflow for enforcing agent capability policy.
Operating and retiring an agent capability
A maintenance and incident response worksheet.