Security Model & Threat Assumptions.
Explicit threat model for Attested Governance Artifacts. What we defend against, what we do not, and the assumptions that underpin our guarantees.
Security Goals
What AGA Proves.
AGA provides verifiable decision integrity, tamper-evident governance records, and portable audit evidence.
It generates cryptographic proof of every governance decision it recorded: each one signed, chained, and independently verifiable. It does not prove the subject took no ungoverned action; that is a deployment property.
Adversary Model
Assumed Attacker Capabilities.
The adversary model assumes an attacker with full access to the local database and network but not the cryptographic signing keys or gateway runtime.
AGA provides structural integrity guarantees independent of payload confidentiality. The system is designed so that even with full visibility into stored data and network traffic, an adversary cannot forge valid receipts or tamper with the governance chain without detection.
Threats Addressed
What AGA Defends Against.
Binary modification
Hash comparison against sealed baseline
Configuration drift
Continuous measurement at policy-defined cadence
Unauthorized dependency changes
Checksum validation of loaded modules
Runtime policy bypass
gateway as mandatory execution boundary
Audit log tampering
Hash-linked receipt chain
Evidence fabrication
Merkle checkpoint anchoring to append-only storage
Replay attacks
Timestamped receipts with sequence numbering
Privilege escalation
Two-process separation; subject holds no signing keys
Supply chain model substitution
Sealed reference hash binds identity at build time
Behavioral drift in tool-call patterns
Statistical analysis over sliding windows, producing signed BEHAVIORAL_DRIFT receipts
Policy bypass via indirect execution
Phantom execution with forensic capture detects circumvention attempts
Threats Not Addressed
Explicit Exclusions.
- Kernel-level or hypervisor compromise of the gateway host
- Hardware microcode or firmware attacks
- Adversarial prompt manipulation at the model level (inference-time semantic defenses are complementary and out of scope)
- Side-channel attacks on the signing key
- Social engineering of the policy issuer
Note: AGA addresses behavioral drift at the tool-call level through statistical analysis over sliding windows. Model-level semantic defenses remain complementary and out of scope.
Trust Assumptions
Foundation of Guarantees.
gateway Integrity
The gateway must execute within a trusted boundary. If compromised, receipt integrity cannot be guaranteed. For highest assurance, the gateway can ingest TEE attestations where present, though this is not required for standard operation.
Key Custody
The policy issuer's signing key must be protected. If the signing key is compromised, forged artifacts become possible. Key rotation is supported through the continuity chain mechanism.
Verification Guarantees
Assurance Levels.
| Level | Steps | Guarantees |
|---|---|---|
| Offline | Six offline checks |
|
| Online | Optional anchor |
|
| Full | Offline checks + anchor |
|
Explore the System.
See how these security properties are implemented in practice across the governance architecture.
Zero-TOCTOU Property for MCP Agents
For MCP-governed AI agents, with the proxy deployed as the sole tool channel, the time-of-check-to-time-of-use window is zero by construction. The gateway is the communication channel. Every tool call passes through the gateway synchronously. The agent cannot invoke a tool without the gateway evaluating it first.
If the gateway is the only path to external resources (applied by network isolation), and every tool call is synchronously evaluated before forwarding, then unauthorized external actions are recorded and, when the boundary is wired as the sole egress path, refused. Internal computation is unconstrained, but internal computation without external action causes no harm. The moment the agent acts, it hits the gateway.
This property is specific to MCP-governed agents where the proxy is the sole communication path. For container and binary subjects, AGA uses periodic measurement with configurable cadence (100ms-5s) and event-driven eBPF probes on the roadmap.
Phantom Mode Limitations
When a quarantine decision is sealed, the artifact specifies phantom mode; in the reference orchestrator the agent receives synthetic responses while actions are captured. Severing real effects is wired per deployment. This captures adversarial intent without alerting the agent.
A sufficiently capable agent could potentially detect phantom mode through timing analysis, response content patterns, or side channels. AGA mitigates this in the reference orchestrator by profiling real response latencies during normal operation and replaying from the recorded distribution during phantom mode. The JSON-RPC envelope structure matches exactly.
The agent would need to specifically allocate reasoning capacity to phantom detection, which requires knowing phantom mode exists. The purpose is to capture intent during the observation window, not to maintain indefinite deception against a determined detection effort.
Logical Problem Resolution
Analysis of the AGA architecture identified 12 non-trivial logical problems. Ten are addressable with engineering; two are irreducible residuals present in any cryptographic governance system.
| Problem | Category | Status | Mitigation |
|---|---|---|---|
| gateway trust | Fundamental | Mitigated | Threshold signing (roadmap); TEE attestation as measurement input (deployer-provided) |
| Key compromise | Fundamental | Mitigated | Key rotation and PQC hybrid (implemented); HSM isolation (roadmap) |
| Policy correctness | Fundamental | Irreducible | Policy provenance chain, coverage metrics |
| Timestamps | Architectural | Mitigated | Roughtime IETF integration, monotonicity verification |
| Identity binding | Architectural | Mitigated | SPIFFE self-signed X.509, certificate chain binding |
| TOCTOU window | Architectural | Solved | MCP proxy is synchronous by construction |
| Proxy bypass | Architectural | Addressed (deployment) | Mandatory network isolation at infra level |
| Phantom detection | Architectural | Mitigated | Timing profiles, envelope matching |
| Recursive governance | Architectural | Roadmap | TEE-hosted gateway with attestation chain |
| Policy rotation | Operational | Solved | POLICY_ROTATION receipt type, zero-gap protocol |
| Performance at scale | Operational | Mitigated | Receipt batching, horizontal scaling |
| Legal admissibility | Operational | Irreducible | Standard primitives, expert witness readiness |