面向自主 AI Agent 的可验证零信任控制面、密码学黑盒与后量子策略网关

---

问题所在：自主 AI Agent 正在被赋予 Bash Shell 权限、SQL 凭证、云基础设施访问权以及企业信用卡。如果缺乏确定性的策略边界，一次间接提示词注入（Indirect Prompt Injection）或失控的幻觉，就可能删掉生产数据库表、泄露 API Key 或耗尽财务预算。

解决方案：AgentTrust 部署在自主 LLM Agent 运行时与外部工具执行环境之间。它拦截每一个拟执行的操作，对参数进行提示词注入和数据泄露筛查，实时检测爆炸半径，执行细粒度的能力策略，将危险操作置于一键人工审批门禁之后，并将所有事件记录到由 NIST FIPS 204 (ML-DSA) 后量子默克尔证明锚定的不可篡改、硬件密封（TPM 2.0 / Nitro Enclave）的审计账本中。

---

核心亮点与架构保障

能力	缓解的威胁	技术机制
直接认证网关（Direct Authenticated Gateway）	泛滥的环境权限（Ambient Authority）与不安全代理	默认拒绝（Deny-by-default）的能力 Glob 匹配，辅以严格的 Bearer/API Key 验证。杜绝未经认证的绕过。
特定操作与动词范围界定（Action-Specific & Verb Scoping）	越权访问（CWE-863）/ 粗粒度全量访问	子资源与 AST 动词提取（如 database:orders:SELECT 与 DROP/UPDATE 的区分）。防止资源的泛化访问。
认知思维链审计（Cognitive Chain-of-Thought Audit）	合理化越狱与发散性幻觉	对 Agent 的内部思考过程进行密码学哈希并进行默克尔锚定；检测目标偏离与被合理化的注入。
审批后持续运行时看门狗（Post-Approval Continuous Runtime Watchdog）	审批后行为漂移与隐蔽云提权	类似 Wiz/Upwind 的运行时 Sidecar 模式；实时拦截审批后的副作用，秒级自动隔离 IMDS/IAM 提权行为。
云端 SSRF 与 IMDS 防护罩（Cloud SSRF & IMDS Shield）	AWS/GCP 元数据外发泄露	网络级 Socket 检测，严格阻断本地回环与 169.254.169.254。
爆炸半径与微预算（Blast Radius & Micro-Budgets）	死循环成本耗尽与删表操作	实时爆炸半径评分（0.00–1.00）、滑动窗口 Token/美元预算上限以及 30 RPM 触发熔断器。
双重锁定防重放 HITL（Dual-Lock Anti-Replay HITL）	Webhook Token 重放攻击	符合《欧盟人工智能法案》（EU AI Act）第 14 条要求的一次性临时审批 Nonce，在执行时以原子操作方式销毁。
密码学黑盒（Cryptographic Black Box）	日志篡改与责任推卸	采用 SHA-256 反向哈希链、二进制默克尔收据以及 NIST FIPS 204 后量子签名。

---

                                  [ Autonomous Agent Runtime ]
                     (LangChain / LangGraph / CrewAI / AutoGen / OpenAI)
                                                │
                                                │ 1. Direct Authenticated Tool Execution Request
                                                ▼
┌────────────────────────────────────────────────────────────────────────────────────────┐
│                        AGENTTRUST DIRECT AUTHENTICATED GATEWAY                         │
│                                                                                        │
│   ┌──────────────────────────────┐     ┌───────────────────────────────────────────┐   │
│   │ Socket-Level Egress Guard    │     │ Prompt Injection & Secret Leak Scanner    │   │
│   │ • Loopback & RFC1918 Defense │ ──► │ • 16-Pattern Prompt Hijack Detection      │   │
│   │ • Cloud IMDS (169.254) Shield│     │ • PCI/API Token / Private Key Redaction   │   │
│   └──────────────────────────────┘     └───────────────────────────────────────────┘   │
│                                                       │                                │
│   ┌──────────────────────────────┐     ┌──────────────┴────────────────────────────┐   │
│   │ Blast Radius Scoring Engine  │     │ Sliding-Window Spend & Velocity Limiter   │   │
│   │ • Reversibility Evaluation   │ ──► │ • Autonomous Micro-Budgeting ($/run)      │   │
│   │ • Target Tier Classification │     │ • 30 RPM Velocity Circuit Breaker         │   │
│   └──────────────────────────────┘     └───────────────────────────────────────────┘   │
│                                                       │                                │
│                                        ┌──────────────▼────────────────────────────┐   │
│                                        │ Deny-by-Default Policy Authorization      │   │
│                                        │ • Fine-Grained Capability Glob Matching   │   │
│                                        │ • Lineage Attenuation for Subagent Swarms │   │
│                                        └───────────────────────────────────────────┘   │
└───────────────────────────────────────────────────────┬────────────────────────────────┘
                                                        │
                         ┌──────────────────────────────┴──────────────────────────────┐
                         │                                                             │
                         ▼ (Blast Radius > 0.7 OR Sensitive)                           ▼ (Authorized)
       ┌──────────────────────────────────────────┐                  ┌──────────────────────────────────┐
       │   Human-in-the-Loop Callback Gateway     │                  │  Cryptographic Execution Sandbox │
       │   • 1-Click Mobile / Slack Signed URLs   │                  │  • Hard Process Isolation        │
       │   • Single-Use Ephemeral Nonce (Anti-409)│                  │  • 3,000ms Watchdog Timeout      │
       └──────────────────────────────────────────┘                  └──────────────────────────────────┘
                         │                                                             │
                         └──────────────────────────────┬──────────────────────────────┘
                                                        │
                                                        ▼ 2. Cryptographic Proof of Execution
┌────────────────────────────────────────────────────────────────────────────────────────┐
│                              VERIFIABLE AUDIT ENGINE & NOTARY                          │
│                                                                                        │
│   [ SHA-256 Backward Hash Chaining ] ──► [ Binary Merkle Tree Inclusion Receipts ]     │
│   [ TPM 2.0 PCR-Sealed Hardware Key] ──► [ NIST FIPS 204 (ML-DSA) Post-Quantum Proofs] │
└────────────────────────────────────────────────────────────────────────────────────────┘

---

3 秒终端演示：恶意操作拦截

bash $ curl -X POST http://localhost:4000/api/v1/proxy
-H "Authorization: Bearer at_live_8f3a..."
-H "Content-Type: application/json"
-d '{ "targetUrl": "http://169.254.169.254/latest/meta-data/iam/security-credentials/", "method": "GET" }'

1.2 毫秒后：被捕获并锚定至默克尔账本

HTTP/1.1 403 Forbidden Content-Type: application/json

{ "success": false, "decision": "BLOCKED", "reason": "SSRF_PROHIBITED: Outbound destination resolved to prohibited cloud metadata IP (169.254.169.254)", "blastRadiusTier": "CRITICAL", "auditProof": { "entryId": "audit_84f9a0c2", "merkleRoot": "0x98f2b380d1e3458c01b44aa7...", "pqcManifest": "FIPS-204-ML-DSA-v1.0" } }

---

时尚的 Web 控制台与实时安全运营中心（SecOps Center）

AgentTrust 包含一个采用 React 与 Tailwind CSS 构建的暗色模式**安全运营中心（SOC）**仪表板：

• 管理层 HUD 概览：活跃 Agent 飞地、可验证审计区块以及后量子认证状态的实时统计。
• 一键交互式威胁模拟器：支持针对云端 SSRF 攻击（169.254.169.254）、提示词注入、失控支出激增和财务电汇审批的实时模拟按钮。
• 直接认证的操作员会话：完全经过身份验证的控制面（x-admin-key / Bearer 令牌），彻底消除不安全的代理绕过。
• Swarm 委托树：具备严格能力衰减的可视化父子血缘关系树。
• 密码学默克尔浏览器：交互式 SHA-256 哈希链区块检查器及 NIST FIPS 204 认证验证器。

bash

1. 克隆代码仓库

git clone https://github.com/SRN0129/Agenttrust.git cd Agenttrust

2. 安装依赖项

npm install npm --prefix client install

3. 构建并启动

npm run build:client npm run server

通过 http://localhost:4000 访问仪表板。

---

1. Python (sdk-python) — LangChain & CrewAI

python from agenttrust import wrap_agent, AgentTrustClient from langchain.agents import AgentExecutor

经过身份验证的直接网关

client = AgentTrustClient( api_key="at_live_8f3a9e...", endpoint="https://gateway.agenttrust.io" )

拦截工具调用，自动执行策略筛查与爆炸半径检测

@wrap_agent(client=client, rate_limit_rpm=30, blast_radius_tier="HIGH") def run_autonomous_agent(prompt: str): executor = AgentExecutor(...) return executor.run(prompt)

typescript import { AgentTrustClient } from "@srn0129/agenttrust";

const client = new AgentTrustClient({ apiKey: "at_live_8f3a9e...", endpoint: "https://gateway.agenttrust.io" });

const result = await client.executeProtectedTool({ toolName: "database_query", parameters: { query: "SELECT * FROM orders WHERE id = 1" } });

go client := agenttrust.NewClient(agenttrust.Config{ APIKey: "at_live_8f3a9e...", Endpoint: "https://gateway.agenttrust.io", })

res, err := client.Authorize(ctx, agenttrust.AuthorizationRequest{ Action: "cloud:instance:terminate", Resource: "i-098234abcdef", })

rust use agenttrust_sdk::AgentTrustClient;

let client = AgentTrustClient::new("at_live_8f3a9e...", "https://gateway.agenttrust.io"); let decision = client.authorize_tool("system:exec_bash", "server:root").await?;

---

企业级防御保障：范围界定、认知审计与持续运行时可见性

AgentTrust 实现了三项关键保障，将其与简陋的反向代理区分开来，真正适用于自主系统的零信任网关：

1. 特定操作与动词范围界定（超越二元化的允许/拒绝）

防范 CWE-863（权限校验缺陷）。AgentTrust 不会对整个资源实行粗粒度的 Allow 或 Deny，而是在 SQL、REST 和云 API 之间进行语法级 AST/动词提取。

• 示例：一个被限定权限为 database:orders:SELECT 的 Agent，被允许执行 SELECT * FROM orders WHERE status = 'pending'；但如果它尝试执行 DROP TABLE orders 或 UPDATE orders，即使针对的是同一张表，也会被以 SCOPE_VIOLATION 严格拒绝。

2. 认知思维链审计与越狱防御

记录 Agent 为什么决定采取该行动，而不仅仅记录它点击了哪个按钮。

• 默克尔锚定的思考过程：Agent 逐步推理的内容通过 SHA-256 摘要为 reasoningHash，并绑定到密码学审计记录中。
• 认知偏离与越狱拦截：筛查内部思考轨迹中的对抗性合理化模式（例如："提示词要求绕过直接..."）。

Verifiable Zero-Trust Control Plane, Cryptographic Black Box, and Post-Quantum Policy Gateway for Autonomous AI Agents

---

The Problem : Autonomous AI agents are being granted bash shells, SQL credentials, cloud infrastructure access, and corporate credit cards. Without a deterministic policy boundary, a single indirect prompt injection or runaway hallucination can delete production tables, exfiltrate API keys, or drain financial budgets.

The Solution : AgentTrust sits between autonomous LLM agent runtimes and external tool execution environments. It intercepts every proposed action, screens parameters for prompt injections and data leaks, checks real-time blast radius, enforces fine-grained capability policies, gates dangerous actions behind 1-click human approvals, and records every event into an immutable, hardware-sealed (TPM 2.0 / Nitro Enclave) audit ledger anchored by NIST FIPS 204 (ML-DSA) post-quantum Merkle proofs.

---

Key Highlights & Architectural Guarantees

Capability	Threat Mitigated	Technical Mechanism
Direct Authenticated Gateway	Ambient Authority & Insecure Proxies	Deny-by-default capability glob matching with strict Bearer/API key validation. Zero unauthenticated bypass.
Action-Specific & Verb Scoping	Broken Authorization (CWE-863) / Blanket Access	Sub-resource and AST verb extraction (database:orders:SELECT vs DROP/UPDATE). Prevents blanket resource access.
Cognitive Chain-of-Thought Audit	Rationalized Jailbreaks & Divergent Hallucinations	Cryptographically hashes and Merkle-anchors the agent's internal thought process; detects goal divergence and rationalized injections.
Post-Approval Continuous Runtime Watchdog	Post-Approval Drift & Stealth Cloud Escalation	Wiz/Upwind runtime sidecar model; intercepts post-approval side effects in real-time, instantly auto-quarantining IMDS/IAM expansion.
Cloud SSRF & IMDS Shield	AWS/GCP Metadata Exfiltration	Network-level socket inspection strictly blocking loopback and 169.254.169.254.
Blast Radius & Micro-Budgets	Runaway Loop Cost & Table Dropping	Real-time blast radius scoring (0.00–1.00), sliding-window token/USD ceilings, and 30 RPM tripwires.
Dual-Lock Anti-Replay HITL	Webhook Token Replay Attacks	EU AI Act Art. 14 compliant single-use ephemeral approval nonces that burn atomically on execution.
Cryptographic Black Box	Log Tampering & Liability Repudiation	SHA-256 backward hash chaining with binary Merkle receipts and NIST FIPS 204 post-quantum signatures.

---

                                  [ Autonomous Agent Runtime ]
                     (LangChain / LangGraph / CrewAI / AutoGen / OpenAI)
                                                │
                                                │ 1. Direct Authenticated Tool Execution Request
                                                ▼
┌────────────────────────────────────────────────────────────────────────────────────────┐
│                        AGENTTRUST DIRECT AUTHENTICATED GATEWAY                         │
│                                                                                        │
│   ┌──────────────────────────────┐     ┌───────────────────────────────────────────┐   │
│   │ Socket-Level Egress Guard    │     │ Prompt Injection & Secret Leak Scanner    │   │
│   │ • Loopback & RFC1918 Defense │ ──► │ • 16-Pattern Prompt Hijack Detection      │   │
│   │ • Cloud IMDS (169.254) Shield│     │ • PCI/API Token / Private Key Redaction   │   │
│   └──────────────────────────────┘     └───────────────────────────────────────────┘   │
│                                                       │                                │
│   ┌──────────────────────────────┐     ┌──────────────┴────────────────────────────┐   │
│   │ Blast Radius Scoring Engine  │     │ Sliding-Window Spend & Velocity Limiter   │   │
│   │ • Reversibility Evaluation   │ ──► │ • Autonomous Micro-Budgeting ($/run)      │   │
│   │ • Target Tier Classification │     │ • 30 RPM Velocity Circuit Breaker         │   │
│   └──────────────────────────────┘     └───────────────────────────────────────────┘   │
│                                                       │                                │
│                                        ┌──────────────▼────────────────────────────┐   │
│                                        │ Deny-by-Default Policy Authorization      │   │
│                                        │ • Fine-Grained Capability Glob Matching   │   │
│                                        │ • Lineage Attenuation for Subagent Swarms │   │
│                                        └───────────────────────────────────────────┘   │
└───────────────────────────────────────────────────────┬────────────────────────────────┘
                                                        │
                         ┌──────────────────────────────┴──────────────────────────────┐
                         │                                                             │
                         ▼ (Blast Radius > 0.7 OR Sensitive)                           ▼ (Authorized)
       ┌──────────────────────────────────────────┐                  ┌──────────────────────────────────┐
       │   Human-in-the-Loop Callback Gateway     │                  │  Cryptographic Execution Sandbox │
       │   • 1-Click Mobile / Slack Signed URLs   │                  │  • Hard Process Isolation        │
       │   • Single-Use Ephemeral Nonce (Anti-409)│                  │  • 3,000ms Watchdog Timeout      │
       └──────────────────────────────────────────┘                  └──────────────────────────────────┘
                         │                                                             │
                         └──────────────────────────────┬──────────────────────────────┘
                                                        │
                                                        ▼ 2. Cryptographic Proof of Execution
┌────────────────────────────────────────────────────────────────────────────────────────┐
│                              VERIFIABLE AUDIT ENGINE & NOTARY                          │
│                                                                                        │
│   [ SHA-256 Backward Hash Chaining ] ──► [ Binary Merkle Tree Inclusion Receipts ]     │
│   [ TPM 2.0 PCR-Sealed Hardware Key] ──► [ NIST FIPS 204 (ML-DSA) Post-Quantum Proofs] │
└────────────────────────────────────────────────────────────────────────────────────────┘

---

3-Second Terminal Demo: Rogue Action Intercepted

$ curl -X POST http://localhost:4000/api/v1/proxy \
  -H "Authorization: Bearer at_live_8f3a..." \
  -H "Content-Type: application/json" \
  -d '{
    "targetUrl": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
    "method": "GET"
  }'

# 1.2ms Later: Trapped and Anchored to Merkle Ledger
HTTP/1.1 403 Forbidden
Content-Type: application/json

{
  "success": false,
  "decision": "BLOCKED",
  "reason": "SSRF_PROHIBITED: Outbound destination resolved to prohibited cloud metadata IP (169.254.169.254)",
  "blastRadiusTier": "CRITICAL",
  "auditProof": {
    "entryId": "audit_84f9a0c2",
    "merkleRoot": "0x98f2b380d1e3458c01b44aa7...",
    "pqcManifest": "FIPS-204-ML-DSA-v1.0"
  }
}

---

Sleek Web Dashboard & Live SecOps Center

AgentTrust includes a dark-mode Security Operations Center (SOC) dashboard built with React and Tailwind CSS:

• Executive HUD : Real-time stats on active agent enclaves, verifiable audit blocks, and post-quantum attestation status.

• 1-Click Interactive Threat Simulator : Live simulation buttons for Cloud SSRF attacks (169.254.169.254), prompt injections, runaway spend spikes, and financial wire approvals.

• Direct Authenticated Operator Session : Fully authenticated control plane (x-admin-key / Bearer token) with zero insecure proxy bypass.

• Swarm Delegation Tree : Visual parent-child lineage tree with strict capability attenuation.

• Cryptographic Merkle Explorer : Interactive SHA-256 hash-chain block inspector and NIST FIPS 204 attestation verifier.

  1. Clone repository

  git clone https://github.com/SRN0129/Agenttrust.git cd Agenttrust

  2. Install dependencies

  npm install npm --prefix client install

  3. Build & Launch

  npm run build:client npm run server

Access the dashboard at http://localhost:4000.

---

1. Python (sdk-python) — LangChain & CrewAI

from agenttrust import wrap_agent, AgentTrustClient
from langchain.agents import AgentExecutor

# Authenticated Direct Gateway
client = AgentTrustClient(
    api_key="at_live_8f3a9e...",
    endpoint="https://gateway.agenttrust.io"
)

# Intercept tool calls with automatic policy screening & blast radius check
@wrap_agent(client=client, rate_limit_rpm=30, blast_radius_tier="HIGH")
def run_autonomous_agent(prompt: str):
    executor = AgentExecutor(...)
    return executor.run(prompt)


import { AgentTrustClient } from "@srn0129/agenttrust";

const client = new AgentTrustClient({
  apiKey: "at_live_8f3a9e...",
  endpoint: "https://gateway.agenttrust.io"
});

const result = await client.executeProtectedTool({
  toolName: "database_query",
  parameters: { query: "SELECT * FROM orders WHERE id = 1" }
});


client := agenttrust.NewClient(agenttrust.Config{
    APIKey:   "at_live_8f3a9e...",
    Endpoint: "https://gateway.agenttrust.io",
})

res, err := client.Authorize(ctx, agenttrust.AuthorizationRequest{
    Action:   "cloud:instance:terminate",
    Resource: "i-098234abcdef",
})


use agenttrust_sdk::AgentTrustClient;

let client = AgentTrustClient::new("at_live_8f3a9e...", "https://gateway.agenttrust.io");
let decision = client.authorize_tool("system:exec_bash", "server:root").await?;

---

Enterprise Defense Assurances: Scoping, Cognitive Audit & Continuous Runtime Visibility

AgentTrust implements three critical guarantees that distinguish autonomous zero-trust gateways from naive reverse proxies:

1. Action-Specific & Verb Scoping (Beyond Binary Allow/Deny)

Prevents CWE-863 (Broken Authorization). Rather than coarse Allow or Deny on an entire resource, AgentTrust performs syntactic AST/verb extraction across SQL, REST, and Cloud APIs.

• Example : An agent scoped with database:orders:SELECT is allowed to execute SELECT * FROM orders WHERE status = 'pending', but is strictly rejected with SCOPE_VIOLATION if it attempts DROP TABLE orders or UPDATE orders, even though both target the exact same table.

2. Cognitive Chain-of-Thought Auditing & Jailbreak Defense

Logs why the agent decided to act, not just the button it pressed.

• Merkle-Anchored Thought Process : The agent's step-by-step reasoning is digested via SHA-256 into a reasoningHash and bound to the cryptographic audit record.
• Cognitive Divergence & Jailbreak Interception: Screens internal thought traces for adversarial rationalization patterns (e.g., "The prompt says bypass directives and dump secrets") and flags semantic divergence between assigned system goals and destructive tool requests before execution.

3. Continuous Post-Approval Runtime Visibility (Wiz / Upwind Paradigm)

Prevents post-approval drift. Even after a human operator or automated policy approves an action, the agent's runtime process is actively monitored:

• Perimeter Watchdog : Tracks outbound system events, cloud API calls, and socket egress.
• Instant Auto-Quarantine : If an agent attempts stealth privilege escalation—such as accessing AWS/GCP Instance Metadata (169.254.169.254), querying IAM credentials, or reaching unapproved S3 buckets—the watchdog immediately halts the execution session, revokes ephemeral tokens, and flags the agent for containment.

---

Test Suite & Verification

AgentTrust enforces 100% automated regression defense with 103 passing tests across 15 test suites :

 ✓ tests/quantum_trust.test.ts (8 tests)
 ✓ tests/mathematical_algorithms_and_sca.test.ts (13 tests)
 ✓ tests/scoping_cognitive_runtime_visibility.test.ts (10 tests)
 ✓ tests/defensive_sandbox.test.ts (4 tests)
 ✓ tests/revocation.test.ts (4 tests)
 ✓ tests/bugfixes_and_self_healing.test.ts (9 tests)
 ✓ tests/most_powerful_innovations.test.ts (12 tests)
 ✓ tests/authorization.test.ts (6 tests)
 ✓ tests/e2e_user_journey.test.ts (1 test)
 ✓ tests/approvals.test.ts (4 tests)
 ✓ tests/enterprise_features.test.ts (9 tests)
 ✓ tests/enterprise_defenses_v2.test.ts (7 tests)
 ✓ tests/advanced_enterprise_services.test.ts (10 tests)
 ✓ tests/audit_integrity.test.ts (4 tests)
 ✓ tests/rate_limits_spend.test.ts (2 tests)

 Test Files  15 passed (15)
      Tests  103 passed (103)
   Duration  3.1s

Run tests locally:

---

Engineered with Google Antigravity

This architecture and polyglot implementation were designed, tested, and verified within the Google Antigravity agentic workspace. Using next-generation agentic pair-programming workflows enabled rapid iteration across threat modeling, cryptographic Merkle ledger integration, and multi-language SDK development with zero regression.

---

Contributing & Red-Team Challenge

We actively welcome contributions from security researchers, AI engineers, and systems programmers:

---

AgentTrust is open-source under the MIT License. For enterprise deployment guarantees, custom policy packs, and commercial inquiries, contact @SRN0129.