01 / The operating case
What changes in a real workflow?
A tool wrapper checks Kubernetes delete, but the agent can also call the cluster API directly through another plugin.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Inventory alternate paths, normalize operation and target, validate the decision response and enforce it at the closest reliable boundary.
Architecture review / negative test
Make the boundary testable.
Draw the actual call graph from model choice to target API, including retries, helper tools and direct SDK calls. The PEP needs authenticated caller context, normalized operation and target, a current decision, and a defined response when the PDP is unavailable. An in-band prompt instruction is not an enforcement point.
03 / Failure and evidence
What goes wrong, and what can be proven?
An advisory model instruction or unreachable wrapper cannot prevent an API call made through a bypass.
Link PEP request, decision receipt and executor response; alert on direct unmediated calls.
04 / Canonical scope
Why this reference stands alone
The runtime hub explains the whole decision cycle; this guide owns placement and bypass tests.
Implementation review
Coverage is a graph of paths to the effect.
A policy enforcement point can block only traffic that reaches it. Draw every route from model, orchestration runtime and MCP server to the protected API. For each route, identify who authenticates the caller, who normalizes arguments, where the decision is obtained and which component prevents the effect. A wrapper around one tool is insufficient if the same agent can call a direct SDK, queue or alternate plugin.
agent → tool wrapper → payment API: checked agent → MCP server → payment API: checked at server/executor agent → direct SDK → payment API: blocked by API policy queue worker → payment API: rechecks bound decision unchecked route count: 0
Run the denial test
Bypass the tool wrapper with a direct API call and then submit the action through a delayed queue. Both paths must enforce an equivalent decision over the final action and parameters. Unreachable policy service must not silently turn a denial into an allow.
Evidence to examine
Retain path inventory, PEP request and result, executor identity, bypass test, queue correlation and observed outcome. Instrument direct-call alerts to detect paths missing from the diagram.
Primary source: OWASP Agent Control Standard ↗
Related: MCP gateway security.
Architecture field test
PEP coverage is a path inventory
Can the agent reach the effect without the check?
- 01Enumerate every execution path
- 02Place interlock on each path
- 03Bind decision to final payload
- 04Reconcile protected-system writes
Work the boundary
A Kubernetes maintenance agent can request deletion through an approved tool and through a direct cluster client. A policy wrapper on only the first path is bypassable. Cluster-side authorization or credential separation must protect the final delete.
| Required facts | Tool wrapper, direct API, queue and alternate plugin routes; workload credentials; decision IDs; protected API audit events. |
|---|---|
| Allow only when | Every consequential path reaches an equivalent policy decision before mutation. |
| Deny when | A wrapper denies an action while a shell tool or private SDK uses the same broad credential to perform it. |
Break the assumption
Block the wrapper then attempt the same operation through every alternate route. Compare cluster mutations with decision IDs. Any unmatched write is a coverage failure, even if the model normally chooses the safe tool.
Design tradeoff
An executor-side interlock has strongest effect visibility but may require changes to protected APIs. Gateway controls are valuable where they cover traffic, but cannot infer state or govern bypass routes they do not see.
For pep coverage is a path inventory, consult OWASP AI Agent Security Cheat Sheet. This worked decision and negative test are ProofGrid analysis.
Continue with Implement an agent PEP.
Primary references