ContractWarden: Kernel-Enforced Damage Boundaries for AI Agents via Human-Authorized Contracts

ContractWarden: Kernel-Enforced Damage Boundaries for AI Agents via Human-Authorized Contracts Dongxu Cui1,2 , Zhichao Gu2 , Ping Zheng2 , Wenshuai Xi2 , Simeng Han2 , and Yong Liao1,*

arXiv:2609.38248v1 [cs.CR] 29 Sep 2026

1

School of Cyber Science and Technology, University of Science and Technology of China, Hefei, China cdx@mail.ustc.edu.cn, yliao@ustc.edu.cn 2 China Greatwall Technology Group Co., Ltd., Shenzhen, China {guzhichao, zhengping, xiwenshuai, hansimeng}@greatwall.com.cn ORCID: 0009-0007-1008-5465 (D. Cui), 0000-0001-6403-0557 (Y. Liao) * Corresponding author: Yong Liao (yliao@ustc.edu.cn)

Abstract—Large language model agents can execute commands, create subprocesses, and directly access files and networks, allowing prompt injection or planning errors to become operating-system side effects. We present ContractWarden, a Linux reference monitor that enforces a human-authorized damage boundary without trusting the agent or its policy suggestions. A model may propose a tri-state asset contract—allow, deny, or no_egress—but a human makes the final choice. An execution gate binds the contract to a concrete task before untrusted code runs. An extended Berkeley Packet Filter (eBPF) Linux Security Modules (LSM) data plane then enforces file and network decisions and monotonically propagates no_egress through processes, regular files, pipes, FIFOs, and supported Unix-domain sockets. All 570 runs across 19 security tests satisfy predefined return-value and side-effect criteria. On three co-located file-I/O workloads, median overhead is 11.96–12.89% in a Linux 6.15 virtual machine and 35.79–61.54% on a Linux 6.15 physical platform, lower than the evaluated frozen ActPlane baseline. The results demonstrate deterministic kernel enforcement for declared assets, supported paths, and controlled object lifecycles. Index Terms—AI agents, human authorization, damage boundary, eBPF LSM, information-flow control, runtime enforcement

I. I NTRODUCTION Large language model (LLM) agents have evolved into systems that plan tasks, invoke tools, execute scripts, and interact with local files and networks [1]. Indirect prompt injection, malicious tool output, or planning errors can therefore produce concrete system effects [2]–[5]. Application-layer validation is insufficient when one accepted tool call expands into a shell, interpreter, native binaries, subprocesses, temporary files, and direct system calls. Three gaps make continuous enforcement difficult. First, attaching policy after process creation leaves a race in which untrusted code can run before registration. Second, processtree inheritance misses lateral transfer through files or interprocess communication (IPC). Third, checking only network

connection establishment misses a connection created before its process reads sensitive data. A restricted agent can otherwise launder its security state through a carrier that appears unrestricted. We ask how an operating system can continuously enforce an asset damage boundary authorized before an untrusted task begins. ContractWarden separates policy proposal, semantic authorization, and privileged installation. A model only proposes a tri-state contract over a declared asset set; a human confirms every action; and a privileged control plane installs a complete, validated contract before releasing the task. Human confirmation is a trusted authorization root, not a claim that humans always classify assets correctly. ContractWarden binds policy to a concrete kernel task using an execution gate and process file descriptor (pidfd). Its eBPF LSM data plane attaches source and no_egress state to kernel task and inode objects, monotonically merges state across supported process, file, pipe, FIFO, and Unix-socket edges, and checks egress at socket creation, connection, and send time. We make three contributions: • a human-authorized, closed-set asset contract that reduces a task damage boundary to bounded kernel actions; • gate-before-exec binding and object-level monotonic propagation that resist state laundering; and • an evaluation of 19 security properties, a fourconfiguration cost decomposition, and a co-located comparison with frozen ActPlane on virtual and physical platforms. Our claims are scoped to declared assets, implemented kernel paths, and the object-lifecycle constraints described below. II. BACKGROUND AND R ELATED W ORK Linux Security Modules mediate security-sensitive file, process, and socket operations; BPF LSM programs can deny an

This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible.

operation before it proceeds [6]. BPF maps retain enforcement state [7], [8], while task and inode local storage associate values with kernel objects rather than recycled numeric identifiers [9]. The verifier constrains program safety [10]. System provenance models processes and kernel objects as graph nodes and interactions as directed edges [11], [12]. CamFlow and CamQuery study whole-system capture and online analysis, while ProTracer, eAudit, and TAPAS reduce or structure audit volume [13]–[17]. Dynamic informationflow systems instead propagate labels across computation and communication [18]. AgentSight applies eBPF events to agent observability [19], and Agent-Warden uses objectlifetime state for process–file provenance in LLM-agent activity [20]. These systems motivate object-level correlation, whereas ContractWarden targets authorization denial before a supported side effect. AgentSpec, AgentBound, Progent, Fides, and CaMeL enforce policies in agent runtimes, server sandboxes, or trusted planner paths [21]–[25]. They provide richer agent semantics and can complement a kernel monitor. Seccomp-BPF, AppArmor, and Landlock impose resource-oriented operating-system boundaries [26]–[28], but do not automatically express the task-conditioned rule “after reading this asset, propagate an egress restriction through an intermediate object.” ActPlane is the closest system: it compiles project and task rules into operating-system policy with cross-event state and information-flow control [29]. ActPlane targets programmable compliance policies; ContractWarden instead targets a small human-authorized asset boundary. We therefore compare overlapping properties without treating either system’s nonoverlapping semantics as failures. III. S YSTEM M ODEL AND D ESIGN A. Contracts and Threat Model The system contains a human authorizer H, model proposer M , task domain Aτ , privileged control plane C, and kernel enforcer K. The human maintains a declared asset set R. For task τ , the confirmed contract is the total function Γτ : R → {allow, deny, no_egress}.

(1)

allow adds no ContractWarden restriction; deny rejects supported file and namespace operations; and no_egress permits local access but prevents a carrier that acquires the state from using managed network egress. Each active task receives a non-reused user-space UUID and a bounded kernel position task_id ∈ [0, 63], represented by source bit bτ . A process or supported object x has state S(x) = ⟨L(x), E(x)⟩, where L is a source bitmap and E is the egress-denial bit. State joins monotonically: ⟨L1 , E1 ⟩ ⊔ ⟨L2 , E2 ⟩ = ⟨L1 ∨ L2 , E1 ∨ E2 ⟩.

(2)

The proposer, task commands, agent inputs, and ordinary descendants are untrusted. They may fork, execute native code, rename files, pass descriptors, relay through supported IPC, connect before reading a restricted asset, and attempt identifier

reuse. We trust the kernel, BPF/LSM path, privileged control plane, and human’s final input. The task lacks root and kernelmanagement capabilities. The design targets six security invariants. Closed authorization requires every enabled asset to appear exactly once and prevents a model suggestion from directly becoming policy. Pre-execution binding prevents untrusted code from running before installation and registration complete. Object identity attaches state to kernel objects rather than only reusable path strings or process identifiers. Monotonic propagation joins state on supported derivation, file, and IPC edges. Pre-sideeffect denial returns EPERM before a prohibited asset or network effect. Finally, fail-closed setup keeps the child behind its gate if validation, installation, registration, or read-back fails. B. Lifecycle and Non-Goals When a root task exits, background descendants may remain. The launcher therefore tracks the derived process tree in a cgroup and cleans task policy only after the cgroup becomes empty. This condition terminates controlled processes but does not prove that a persistent inode or an out-of-cgroup receiver discarded an older source bit. A bounded source position cannot be safely reused until the implementation provides generation tags, complete global liveness accounting, or conservative non-reuse. Object-local storage does, however, make ordinary task and inode release independent of recycled numeric PIDs and inode numbers. The monitor does not attempt to prove that an agent’s plan is correct or that the human selected an optimal action. It does not protect undeclared assets, infer implicit or byte-level flows, mediate every IPC and device type, survive a compromised kernel, or provide an ordinary in-task declassification operation. These exclusions delimit the conditional invariant: given a complete confirmed contract, the supported side effects and propagation paths must obey it. C. Authorization and Pre-Execution Binding The model receives asset identifiers and metadata but need not receive canonical local paths. The control plane rejoins confirmed actions with its local asset table and rejects missing, duplicate, unknown, or out-of-domain actions. The proposer cannot authorize and the human does not directly mutate BPF maps. The launcher creates a child blocked on a dedicated file descriptor, obtains a pidfd, and sends the pidfd, task identifiers, and contract to the daemon over an authenticated Unix SOCK_SEQPACKET channel. The daemon validates peer credentials and pidfd/PID consistency, installs asset policy, attaches task state, and reads it back. Only then does the launcher open the execution gate. Failure leaves the workload blocked and triggers rollback. The pidfd identifies a concrete process object, while BPF task storage follows kernel-task lifetime.

D. Compilation, Propagation, and Denial The control plane resolves an existing asset to a (device, inode) key. Its value contains deny and no_egress source bitmaps; an update changes only one task’s bit. Existing directory descendants are enumerated, while a bounded kernel ancestor walk covers later creations. Paths beyond 32 ancestors are outside the current scope. Multiple tasks can safely share the long-lived data plane: installation for one task preserves every other active source bit on the same object. Directory compilation does not follow symbolic links into another tree and rejects a contract that expands past 4,096 policy keys. A local canonical path is therefore control-plane metadata; kernel decisions use object identity and a bounded ancestor relation. For processes P, Q and supported object O, the kernel performs S(Q) ← S(Q) ⊔ S(P )

on process derivation,

S(O) ← S(O) ⊔ S(P )

on writable access,

S(P ) ← S(P ) ⊔ S(O)

on readable access.

(3)

Regular files, FIFOs, and anonymous pipes use inode state. Because Unix-stream peers have different inodes, the sender joins state into a peer-state container and the receiver absorbs it. The permission-level approximation can over-propagate, but prevents ordinary code from clearing state by re-executing or relaying through an intermediate carrier. A supported file operation is denied when the task’s sources intersect the target inode’s deny bitmap. The implementation covers open, create, truncate, unlink, and both rename endpoints. A no_egress match allows the file access while setting E(P ) = 1 in the same decision path. Egress checks at socket creation, connect, and send cover new sockets, connected TCP/UDP, established connections, and connectionless datagrams. Unix sockets are local propagation channels. An exec changes the program image without clearing task state. Removing an asset rule stops future matches but cannot revoke no_egress already held by a live task or object. This monotonicity prevents an ordinary task from declassifying itself, although it can create false positives. A trusted release mechanism is deliberately left outside the task’s authority. Table I summarizes the state and enforcement path. A crossprocess lock serializes writers; the loader validates schema, asset type, bit consistency, action disjointness, and map layouts, then snapshots and restores affected keys on update failure. Audit events use a ring buffer independent of the LSM return value, so audit pressure cannot turn deny into allow. IV. I MPLEMENTATION AND E VALUATION A. Prototype and Method The prototype comprises ordinary-user asset and contract tools, a C launcher and privileged daemon, a policy loader, and a CO-RE BPF data plane. It requires BPF LSM, BPF Type Format, bpffs, cgroup v2, pidfd, and task/inode local storage. The daemon maintains one BPF instance for multiple tasks. Task storage is attached to the thread-group leader so

TABLE I P ROTOTYPE S TATE , H OOKS , AND B OUNDS State/path

Purpose

Bound/hooks

Task storage Inode storage Asset policy

Source and egress state File and IPC propagation Deny/egress bitmaps

Unix-peer map File LSM

Peer receive state Access and propagation

Socket LSM

Egress and Unix flow

Process trace Event ring

Inherit and audit Asynchronous evidence

64 source positions Object lifetime 4,096 keys; 32 ancestors 4,096 keys open, permission, create, truncate, unlink, rename create, connect, send, receive fork and exit 256 KiB plus drop count

threads share logical state. The loader uses bounded JSON parsing and verifies contract version, task bit, asset identity and type, action-set disjointness, and BPF map key/value layouts. Table II lists the enforcement path. We separately evaluate security behavior, mechanism cost, and a frozen ActPlane baseline. Model calls and human interaction are outside timing; performance runs use deterministic proposals but traverse contract validation, persistence, policy loading, gating, and registration. ContractWarden security and cost decomposition run on Linux 7.0. The baseline property tests use a Linux 6.15 VMware guest because frozen ActPlane requires that kernel. Co-located performance runs under Linux 6.15 both in the eight-vCPU guest and directly on an AMD Ryzen AI MAX+ 395 platform with 32 logical processors. We compare absolute times only within a platform batch. Each performance configuration has five warmups and 30 measured repetitions in randomized within-repetition order. For system s and repetition r, paired overhead is Os,r =

Ts,r − TN,r × 100%, TN,r

(4)

where TN,r is Native time in the same repetition. Intervals use 10,000 bootstrap resamples of the 30 paired overheads. Figures 1 and 2 summarize the property outcomes and paired overheads that the following subsections analyze. B. Security Correctness Security tests use system-call return values and resource side effects as primary criteria, rather than audit events alone. Each repetition randomizes all 19 cases and cleans controlled processes and policy between cases. All 570 observations (19 cases × 30 repetitions) pass, and the aggregate ring-buffer drop count is zero. Table IV groups the tested properties. Cases 3 and 13 establish the need for send-stage enforcement. Case 11 verifies both return values and filesystem effects; case 14 covers pre-execution rejection and rollback. Thus, within the implemented paths, the monitor preserves source isolation, monotonic propagation, and pre-side-effect denial. The cases exercise four complementary boundaries. Isolation tests separate sources, siblings, and reused identities. Propagation tests cover process derivation and every currently

TABLE II E BPF ATTACHMENT P OINTS AND R ESPONSIBILITIES

Attachment

Responsibility

Attachment

Responsibility

lsm/file_open

Asset decision and regular-file propagation Protected directory creation denial Unlink denial New external-socket denial Established-send denial and Unix send flow Child-state inheritance Hash-key cleanup at inode release

lsm/file_permission

Pipe/FIFO flow and socket-fd write check

lsm/path_truncate lsm/inode_rename lsm/socket_connect lsm/socket_recvmsg

Truncation denial Source and destination rename checks Destination connection denial Unix receiver absorption

sched_process_exit

Exit audit

lsm/inode_create lsm/inode_unlink lsm/socket_create lsm/socket_sendmsg sched_process_fork security_inode_free

TABLE III C O -L OCATED F ILE -I/O P ERFORMANCE (M EDIAN OF 30 PAIRED T RIALS ) Platform

Workload

Native ms

ActPlane ms

AP overhead [95% CI]

ContractWarden ms

CW overhead [95% CI]

VM

Public read Protected read 14 assets

14864.1 14948.1 10875.7

19807.8 24051.6 16612.5

33.39% [33.04,33.81] 61.02% [60.70,61.11] 52.44% [52.13,53.16]

16617.4 16862.4 12210.9

11.96% [11.64,12.14] 12.89% [12.66,13.05] 12.32% [11.90,12.64]

Physical

Public read Protected read 14 assets

810.1 830.4 994.0

1916.4 136.94% [135.89,138.24] 2245.1 170.72% [169.78,172.18] 2775.0 179.03% [178.25,181.35]

1281.7 1338.0 1351.2

58.32% [57.74,58.91] 61.54% [60.49,62.37] 35.79% [35.48,36.38]

P: Pass

Pa: Partial

U: Unsupported

F: Fail

D: Different

ContractWarden

P

P

P

P

P

P

P

P

P

P

P

P

P

P

P

P

P

P

P

ActPlane

P

P

U

P

P

P

P

Pa

P

P

F

Pa

U

Pa

Pa

P

F

F

D

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

Security test case Fig. 1. Outcomes for the 19 target properties. ContractWarden results use 30 repetitions per property; frozen ActPlane uses one execution per property.

ActPlane

Runtime overhead vs. Native (%)

simple fork inheritance does not imply that file-mediated or peer-socket laundering is prevented.

ContractWarden

VMware (8 vCPUs)

200

Physical (Ryzen AI MAX+ 395) 179.0%

170.7%

160

C. Cost and Frozen-Baseline Comparison

136.9%

120

80 61.0%

40

58.3%

52.4%

61.5% 35.8%

33.4% 12.0%

12.9%

Public-file read

Protected-file read

12.3%

0 14-asset macro

Public-file read

Protected-file read

14-asset macro

Fig. 2. Median paired runtime overhead relative to Native, with 95% bootstrap intervals.

supported persistent or transient carrier. Enforcement tests check both newly created and already established network channels, including all four send interfaces exercised by the harness. Lifecycle tests cover rule replacement, failed installation, object release, PID reuse, and the documented directorydepth boundary. This partition matters because a pass on

The cost decomposition uses Baseline (not loaded), Loadedidle (BPF loaded, measured task unregistered), Tracing (task registered with allow-all policy), and Full (asset policy enabled). Two microbenchmarks execute one million open/read/close transactions; a 14-asset macrobenchmark executes 700,000. All 420 trials are valid. Median Full overhead is 21.16–35.62%; most of the observed increase is between Loaded-idle and Tracing, while the Tracing–Full difference is smaller. We do not interpret this observation as zero policy-lookup cost. Frozen ActPlane first passes a preflight confirming real eBPF loading and EPERM denial on Linux 6.15. Against the same 19 target properties, one execution per property yields 9 Pass, 3 Fail, 4 Partial, 2 Unsupported, and 1 Different. Non-pass outcomes primarily reflect a missing sendstage enforcement point, creation leaving an empty file before denial, absent Unix-peer propagation, and different update,

TABLE IV S ECURITY P ROPERTIES AND R ESULTS No. Property

Primary behavioral criterion

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

Restricted task gets EPERM; other source reads Network succeeds without restricted state Send succeeds before and fails after infection Infected branch denied; sibling remains usable Child inherits no_egress A writes, B reads, then B cannot network Restricted child exit does not infect parent New rule applies; removal retains acquired state A–FIFO–B causes B egress denial 32 targets denied; 32 controls allowed Write/create/truncate/rename/unlink leave no forbidden effect Links/rename do not bypass; reused inode is clean send, sendto, sendmsg, write denied Six invalid/injected failures do not start target New process does not inherit old task state Producer–pipe–consumer propagates restriction Receiver absorbs sender state Receiver absorbs sender state Depth 31 matches; depth 32 is outside scope

Source-isolated deny Public asset Post-infection established send Sibling isolation Fork inheritance Cross-task regular file No reverse flow on exit Hot update and monotonicity FIFO propagation 64-bit source isolation File-operation coverage Aliases and inode lifetime Established-socket sends Invalid setup and rollback PID reuse Anonymous pipe Unix stream peer Socketpair peer Directory ancestor bound

TABLE V F ILE -I/O C OST D ECOMPOSITION Workload

Configuration Median ms Paired %

Public 106

Baseline Loaded-idle Tracing Full

764.663 871.964 1019.968 1019.965

– 14.077 33.592 33.230

Protected 106

Baseline Loaded-idle Tracing Full

787.789 889.757 1058.295 1069.548

– 13.220 34.788 35.622

14 assets

Baseline Loaded-idle Tracing Full

962.830 1034.648 1156.708 1165.788

– 7.666 20.287 21.156

identity, or directory semantics. These categories indicate partial comparability or different expression points, not ten generic failures; the properties also do not cover all ActPlane temporal-policy features. For co-located performance, Native, ActPlane, and ContractWarden use identical benchmark code, files, counts, and content hashes. Table III reports medians from 30 measured trials per cell. All 630 trials (including warmups) are valid; hashes match, and the maximum drop count across 210 ContractWarden daemon lifecycles is zero. ContractWarden overhead is 11.96–12.89% in the eightvCPU VMware guest and 35.79–61.54% on the 32-thread AMD Ryzen AI MAX+ 395 platform, versus 33.39–61.02% and 136.94–179.03% for frozen ActPlane. Bootstrap intervals do not overlap within either platform. The higher percentages on the faster physical baseline show why platforms must be interpreted separately; the result is not an overall feature ranking. The virtual and physical batches agree on the ordering but not on percentage magnitude. The same fixed per-operation work occupies a larger fraction of a faster native runtime, and the guest additionally includes hypervisor scheduling.

Pass/Run 30/30 30/30 30/30 30/30 30/30 30/30 30/30 30/30 30/30 30/30 30/30 30/30 30/30 30/30 30/30 30/30 30/30 30/30 30/30

Accordingly, we draw only within-batch conclusions. Timing covers steady-state workload execution and excludes engine startup, model proposal, and human confirmation; the latter are deployment and usability costs rather than per-operation data-plane costs. V. D ISCUSSION AND L IMITATIONS A. Authorization and Declassification The guarantee is conditional on the human-confirmed contract: an omitted asset or permissive choice remains possible. Human confirmation determines who authorizes the boundary, not whether the judgment is objectively correct. User studies are needed for usability, decision time, alert fatigue, and contract-quality claims, but are distinct from testing whether a fixed contract becomes kernel denial. Permission-level propagation may approximate the ability to write as actual influence and therefore over-taint a task. The trade-off keeps state bounded while reducing missed propagation through intermediate carriers. Restoring egress should require a trusted declassification mechanism, such as an attested transformation or independently authorized release; ordinary task code must not remove a label merely by declaring data safe. B. Lifecycle and Policy Publication The 64-bit source representation makes joins fixed-width but bounds the active namespace. Cgroup drainage proves that the derived task tree exited; it does not prove every persistent inode or out-of-cgroup receiver discarded a source bit. Safe reuse requires generation tags, global liveness tracking, or conservative non-reuse. Multi-key updates are serialized and rolled back on failure but are not linearizable to concurrent kernel readers; double-buffered maps with a one-key generation switch are a natural extension. C. Scope and External Validity The prototype does not cover undeclared assets, implicit or byte-level flows, every IPC/device class, a root-compromised

host, general in-task declassification, or destination allowlists. A deployment can compose a container or Landlock for maximum privilege, ContractWarden for task-conditioned assets, and an agent runtime for semantic feedback. One physical machine, one VM, and file-I/O microbenchmarks do not represent all agent workloads. Random order, warmups, content hashes, and pairing reduce temporal noise but do not eliminate VM scheduling effects. Network, fork/IPC, update, concurrent-task, multi-kernel, and realistic agent workloads remain evaluation extensions. The 19 properties derive from our damage-boundary threat model and are therefore better aligned with ContractWarden than with the full ActPlane policy language. The frozen comparison uses only one execution per ActPlane property and supports a coverage observation, not a repeated passrate estimate. Security, decomposition, and co-located measurements also come from separate kernel batches; we never compare absolute time across those batches. The physical run removes hypervisor scheduling as a confounder but still represents one machine. These design choices bound the evidence without changing the within-batch paired measurements or the repeated ContractWarden security criteria. VI. C ONCLUSION Within this scope, ContractWarden turns a humanauthorized asset contract into task-bound kernel state. Gatebefore-exec registration prevents a startup race; object-level monotonic propagation prevents supported carrier laundering; and file plus multi-stage network hooks deny prohibited side effects. All 570 security observations pass, while co-located tests show lower overhead than the evaluated frozen ActPlane configuration. Future work will add generation-safe source reuse, atomic policy publication, trusted declassification, and realistic concurrent agent workloads. AI D ISCLOSURE During preparation, the authors used Google Gemini, and OpenAI Codex for English editing, manuscript organization, and readability. The authors reviewed all AI-assisted content and take responsibility for the manuscript, citations, and results. R EFERENCES [1] L. Wang, C. Ma, X. Feng, Z. Zhang, H. Yang, J. Zhang, Z. Chen, J. Tang, X. Chen, Y. Lin, W. X. Zhao, Z. Wei, and J. Wen, “A survey on large language model based autonomous agents,” Frontiers of Computer Science, vol. 18, no. 6, p. 186345, 2024. [2] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world LLMintegrated applications with indirect prompt injection,” in Proc. ACM Workshop on Artificial Intelligence and Security, 2023, pp. 79–90. [3] H. Zhang, J. Huang, K. Mei, Y. Yao, Z. Wang, C. Zhan, H. Wang, and Y. Zhang, “Agent security bench: Formalizing and benchmarking attacks and defenses in LLM-based agents,” in Proc. International Conference on Learning Representations, 2025. [4] OWASP Foundation, “OWASP Top 10 for LLM Applications 2025,” OWASP Foundation, Tech. Rep., 2025. [5] M. Lupinacci, F. A. Pironti, F. Blefari, F. Romeo, L. Arena, and A. Furfaro, “The dark side of LLMs: Agent-based attack vectors for system-level compromise,” arXiv:2507.06850, 2025.

[6] The Linux Kernel Documentation, “LSM BPF Programs,” [Online]. Available: https://docs.kernel.org/bpf/prog lsm.html, 2026, accessed: Aug. 30, 2026. [7] B. Gregg, BPF Performance Tools: Linux System and Application Observability. Addison-Wesley Professional, 2019. [8] The Linux Kernel Documentation, “BPF Maps,” [Online]. Available: https://www.kernel.org/doc/html/latest/bpf/maps.html, 2026, accessed: Aug. 30, 2026. [9] Linux man-pages Project, “bpf-helpers(7): eBPF helper functions,” [Online]. Available: https://man7.org/linux/man-pages/man7/bpf-helpers.7. html, 2026, accessed: Aug. 30, 2026. [10] H. Sun and Z. Su, “Validating the eBPF verifier via state embedding,” in Proc. USENIX Symposium on Operating Systems Design and Implementation, 2024, pp. 615–628. [11] S. T. King and P. M. Chen, “Backtracking intrusions,” in Proc. ACM Symposium on Operating Systems Principles, 2003, pp. 223–236. [12] Z. Li, Q. A. Chen, R. Yang, Y. Chen, and W. Ruan, “Threat detection and investigation with system-level provenance graphs: A survey,” Computers & Security, vol. 106, p. 102282, 2021. [13] T. Pasquier, X. Han, M. Goldstein, T. Moyer, D. Eyers, M. Seltzer, and J. Bacon, “Practical whole-system provenance capture,” in Proc. ACM Symposium on Cloud Computing, 2017, pp. 405–418. [14] T. Pasquier, X. Han, T. Moyer, A. Bates, O. Hermant, D. Eyers, J. Bacon, and M. Seltzer, “Runtime analysis of whole-system provenance,” in Proc. ACM Conference on Computer and Communications Security, 2018, pp. 1601–1616. [15] S. Ma, X. Zhang, and D. Xu, “Protracer: Towards practical provenance tracing by alternating between logging and tainting,” in Proc. Network and Distributed System Security Symposium, 2016. [16] R. Sekar, H. Kimm, and R. Aich, “eaudit: A fast, scalable and deployable audit data collection system,” in Proc. IEEE Symposium on Security and Privacy, 2024, pp. 3571–3589. [17] B. Zhang, Y. Gao, C. Yu, B. Kuang, Z. Zhang, H. Kim, and A. Fu, “Tapas: Efficient online APT detection with task-guided process provenance graph segmentation and analysis,” in Proc. USENIX Security Symposium, 2025, pp. 607–624. [18] W. Enck, P. Gilbert, B.-G. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. N. Sheth, “TaintDroid: An information-flow tracking system for realtime privacy monitoring on smartphones,” in Proc. USENIX Symposium on Operating Systems Design and Implementation, 2010, pp. 393–407. [19] Y. Zheng, Y. Hu, T. Yu, and A. Quinn, “Agentsight: System-level observability for AI agents using eBPF,” in Proc. Workshop on Practical Adoption Challenges of ML for Systems, 2025, pp. 110–115. [20] D. Cui, Z. Gu, P. Zheng, S. Han, and Y. Liao, “Agent-warden: eBPFbased kernel-native process–file provenance tracking for LLM agents,” 2026, unpublished manuscript. [21] H. Wang, C. M. Poskitt, and J. Sun, “Agentspec: Customizable runtime enforcement for safe and reliable LLM agents,” in Proc. IEEE/ACM International Conference on Software Engineering, 2026. [22] C. Bühler, M. Biagiola, L. Di Grazia, and G. Salvaneschi, “Agentbound: Securing execution boundaries of AI agents,” Proceedings of the ACM on Software Engineering, vol. 3, no. FSE, pp. 2141–2164, 2026. [23] T. Shi, J. He, Z. Wang, H. Li, L. Wu, W. Guo, and D. Song, “Progent: Securing AI agents with privilege control,” arXiv:2504.11703, 2025. [24] M. Costa, B. Köpf, A. Kolluri, A. Paverd, M. Russinovich, A. Salem, S. Tople, L. Wutschitz, and S. Zanella-Béguelin, “Securing AI agents with information-flow control,” arXiv:2505.23643, 2025. [25] E. Debenedetti, I. Shumailov, T. Fan, J. Hayes, N. Carlini, D. Fabian, C. Kern, C. Shi, A. Terzis, and F. Tramèr, “Defeating prompt injections by design,” in Proc. IEEE Conference on Secure and Trustworthy Machine Learning, 2026. [26] The Linux Kernel Documentation, “Seccomp BPF: Secure computing with filters,” [Online]. Available: https://docs.kernel.org/userspace-api/ seccomp filter.html, 2026, accessed: Aug. 29, 2026. [27] AppArmor Project, “AppArmor Documentation,” [Online]. Available: https://apparmor.net/, 2026, accessed: Aug. 29, 2026. [28] The Linux Kernel Documentation, “Landlock: Unprivileged access control,” [Online]. Available: https://www.kernel.org/doc/html/latest/ userspace-api/landlock.html, 2026, accessed: Aug. 29, 2026. [29] Y. Zheng, T. Wu, Q. Fu, T. Yu, W. Mao, T. Ma, D. Williams, W. Wang, and A. Quinn, “Actplane: Programmable OS-level policy enforcement for agent harnesses,” arXiv:2606.25189, 2026.

Related documents

• ContractWarden: Kernel-Enforced Damage Boundaries for AI Agents via Human-Authorized Contracts#1142849
• Software Engineering in the Agent Era From Trustworthy Change to Human Agent Software Organizations#927901
• AgentKernel: The Trust-Native Agentic Operating System#1077575
• A Governance Methodology Layer for AI-Assisted Software Development: Defect Taxonomy, Controlled Ablation, and a Test of Process-Over-Capability#1110331
• An AI Agent Execution Environment to Safeguard User Data#123973