Security boundaries in agentic architectures

This post introduces a security architecture for agentic systems by defining four actors (Agent, Agent Secrets, Generated Code Execution, Filesystem) and their respective trust levels. It proposes security boundaries to mitigate risks like prompt injection and credential theft. Architectures discussed include zero boundaries (default), secret injection proxy, and separating agent compute from sandbox compute. The latter architecture places agent and generated code in separate security contexts, with generated code unable to access secrets directly, and recommends scoped tool invocations for agents.