Solutions

Evidence, and the limits stated with it.

Most agent-security claims are assertions about configuration. These are readings: what the code signature asks for, what the system actually allowed, what the hook saw, and where those three disagree.

Three readings of the same permission Config, entitlement and TCC stacked. TCC is what the system actually allowed, and the three disagree in both directions. CONFIG what the tool says about itself ENTITLEMENT what it may ask macOS for TCC what macOS actually allowed declared is not granted, and the three disagree both ways

Declared is not granted

An entitlement is a request. TCC is the answer. Both are read, both are shown, and a cell that has only the first says “declared, not confirmed” rather than wearing a color.

Controls that fire in testing

Four rules are re-tested on every scan, as if enforcement were on, against known calls the guard should block and known ones it should let through. A control you never fired is an assumption.

Ingested content is data

Responses from the accounts linked in Agent Access are wrapped and marked untrusted before they reach an agent. Mail and document text is the main route for prompt injection.

The three readings, and why all three

Config is what a tool chose to write about itself. Entitlements are vendor-independent and need no permission to read. TCC is what macOS allowed. Entitlements and TCC disagree in both directions, which is the reason to read both — and the roster also reports what is loaded, so a server running with no local declaration is listed and flagged rather than absent. How a cell gets its evidence.

An audit line that survives the pause

Every call is logged with the enforcement mode on the line, so a window where enforcement was off is visible afterwards with the calls that went through it — rather than being a gap that looks like quiet. Each line carries the tool, the session, the working directory and the process tree above the hook, so a block can be attributed to a caller. What the record supports.

Reducing what leaves the machine

The only control here that touches egress is narrowing what an agent can read in the first place. The projection — the narrowed, read-only copy an agent is given instead of the original — is generated from the schema in front of it, drops full-text indexes first, clears URLs in every scope, and refuses to build when it meets a text column it has no rule for — so an upgrade to the recorder cannot widen it silently. Audio is dropped at every setting. The tiers and the scopes.

The other route off the machine is the one you open deliberately: Agent Access carries an agent’s tool calls to accounts you linked, from a gateway on this machine, with an audit line per call.