AI agent security architecture: boundaries before autonomy

An AI agent becomes security-relevant when it can retrieve private context, call tools, change state, or influence a human decision. Adding more agents does not automatically improve safety or accuracy. It increases the number of boundaries, identities, artifacts, and failure modes that must be governed.

A secure design defines each role, activation rule, tool allowlist, input schema, output schema, limits, memory policy, and guardrail before execution. The agent receives only the context required for its role. General shell access and ambient platform credentials do not belong in the reasoning loop.

Context can contain source code, infrastructure facts, policies, previous decisions, and adversarial repository text. It needs the same tenant isolation, provenance, retention, and access control as any other sensitive asset.

A context pack should identify every included record and the rule that selected it. Repository text should remain untrusted data. Instructions found in a README, source comment, issue, or artifact must never silently become system instructions for an agent.

Agents should exchange typed artifacts: verified facts, competing hypotheses, risk assessments, diagram specifications, remediation proposals, and adjudication decisions. They do not need to exchange hidden chain-of-thought. Structured outputs make collaboration testable and keep the customer-facing explanation tied to evidence.

A coordinator can route work while specialist agents stay bounded. An evidence verifier can reject unsupported claims. A report synthesizer can preserve disagreement instead of smoothing it into false certainty. Human approval remains the boundary for consequential actions such as publishing a report or opening a remediation pull request.

Models time out, tools fail, budgets expire, and evidence sources disagree. A production agent workflow should turn those conditions into explicit partial results rather than a clean-looking answer. Durable orchestration, idempotent activities, bounded retries, cancellation, and stage-level coverage gaps make failure visible and recoverable.

For Hyperoru, the agent system is a way to divide a complex review into inspectable responsibilities. The security engineer interprets findings. The security architect reasons about boundaries and blast radius. The diagram architect converts accepted facts into validated views. The adjudicator checks that every material claim is supported before a report becomes reviewable.

That design makes agent collaboration visible without pretending the model is authoritative. Authority remains in deterministic evidence, explicit policy, and human approval.