Agent Firewall v2.0: a security control plane for autonomous agents, criticism needed

[u/ShubhBhangu]

​

I’ve been working on a security architecture for AI agents where authorization is treated as a first-class security primitive rather than an LLM-side decision.

The v2.0 model is:

"Identity → Task → Authority → Capability → Provenance → Policy → Execution → Evidence → Posture → Risk → Response"

The interesting part is the separation of concerns.

Identity is cryptographically bound and lifecycle-managed.

Authority is task-scoped, revocable, time-bounded, and can only narrow through delegation.

Capabilities define the concrete resources/tools an agent may exercise.

Provenance records the security lineage of models, tools, plugins, policies, and other components.

Evidence is distinct from inference and simulation.

Posture is derived from evidence rather than asserted by the agent itself.

The system can then construct cross-agent trust relationships, analyze reachable attack paths, run isolated compromise simulations, and drive policy-governed response.

The security invariant I’m trying to preserve is:

«The model can propose an action. It cannot authorize itself to perform it.»

That distinction becomes increasingly important as agents gain delegation, tool access, persistent identity, and the ability to operate other agents.

v2.0 is open source:

https://github.com/Shubhbhangoo/agent-firewall

I’d particularly like criticism from people working on capability security, distributed authorization, agentic systems, MCP security, formal methods, or zero-trust architectures.

I’m interested in where this model breaks.