The Security Invariant
TracePermit is constructed around a central, non-negotiable security invariant:
Every supported simulated side effect must pass through a controlled enforcement point. The gateway records what it observed, derives intent and risk itself, evaluates policy, and only then releases the action to a safe simulator adapter.
The Ten Core Security Axioms
1. Evidence Before Claims
Never accept authenticated, delegated, or verified merely because a request body or client header says so. A trusted gateway adapter must derive those fields from cryptographic signatures, mTLS certificate fingerprints, or kernel process observation.
2. Action Before Prompt
Prompt injection can easily trick a large language model into believing it is acting benevolently. TracePermit evaluates the structured, normalized action about to execute (tool, arguments, target, resource), regardless of the natural-language prompt that triggered it.
3. Complete Mediation
Within the supported POC paths, no side-effecting simulator tool has an unmediated fast path. This does not establish control over arbitrary host processes, all third-party tools, or direct access to real enterprise targets.
4. Least Authority
Execution permits live at most 60 seconds and bind the exact canonical operation. Delegation credentials have independently bounded lifetimes and scopes. No real downstream target credential is configured in the POC.
5. Causal Lineage $\neq$ Authority Delegation
If Agent A calls Agent B, Agent B does not automatically inherit Agent A's privileges. Cryptographic delegations must be explicitly signed, parent-hash linked, and strictly monotonically narrowed (cannot broaden scope, target resources, or lifetime).
6. Single-Use Execution Permits (Anti-TOCTOU)
To prevent Time-of-Check to Time-of-Use (TOCTOU) race conditions, policy evaluation does not directly dispatch the tool. Instead, it mints a cryptographic Execution Permit (JWS) bound to: $$\text{Permit} \longleftrightarrow {\text{Subject}, \text{CanonicalActionHash}, \text{Resource}, \text{PolicyVersion}}$$ The downstream adapter consumes the permit atomically before invoking the target. If the payload is modified, the hash fails and execution is denied.
7. Dual Control for Destructive Operations
Sensitive actions (e.g. database deletions, infrastructure termination, permission escalation) require human sign-off where: $$\text{Requester} \neq \text{Approver}$$ Self-approval is rejected fail-closed.
8. Fail Closed
Missing, malformed, expired, or unknown credentials, tools, or policy versions always result in an explicit BLOCK decision.
9. Simulator First
New tool adapters and dangerous capabilities must first be verified against deterministic, stateful simulators. The current POC grants no real cloud credential.
10. Audit Honesty
If a target operation times out or returns an ambiguous network error, TracePermit marks the outcome as UNKNOWN. It does not guess or blindly retry. A read-only reconciliation worker probes the target to verify the actual state before appending a terminal event.