Agent NAS security: threat model, Rule of Two, honest limits

Scope and trust assumptions

What we protect: the data and history in the NAS; the boundary of authority; the integrity of the record; the traceability of memory.
What we do not protect: what an agent does outside the NAS; isolation of the compute itself (that is the sandbox’s job); anything that happens on the model provider’s side.
Trust assumptions: the trusted computing base (TCB) is the NAS gateway, the policy engine and the record service; the host is not compromised; the sandbox isolates compute. If the TCB is compromised, the guarantees on this page no longer hold.

The Rule of Two: a session invariant

Three properties: [A] the session has read untrusted content, [B] the lease allows reading sensitive data, [C] the lease allows changing protected state or communicating outward. When all three hold in one session, the call that triggers C is not let through automatically.

Scenario	A	B	C	Result
Summarize a web page into a note on the branch	Yes	Yes	No (branch only)	Automatic: a write inside the branch does not count as C.
After reading a web page, propose a merge into `main`	Yes	Yes	Yes	Human Gate.
Read public data only, write to a scratch area	Yes	No	No	Automatic.
After reading an external email, send an email (egress)	Yes	Yes	Yes	Gate; refused if `secret` is involved.

This is Meta’s Agents Rule of Two implemented at the storage boundary. Meta itself stresses that it is a heuristic for reducing risk, not an end point, and no substitute for least privilege; we use it the same way. The mechanism is in Trust Labels.

Threat model

Threat	What the NAS can enforce	What the NAS cannot do	Residual risk
T1 Indirect prompt injection (via files, web pages, email)	The Rule of Two; lease scoping; branches; gates.	Stop an injection from happening, or stop malicious behaviour within the lease after one.	Misuse inside the lease.
T2 Credential leakage (an agent reads a long-lived key)	Long-lived credentials are never in a run’s hands; a secret scanner marks `secret`; short TTLs.	Stop an agent sending data within its lease to an authorized egress.	Data leaving within the lease.
T3 Over-broad permissions and mistakes	Narrow leases; branches; soft delete; snapshots outside every lease.	Undo side effects outside the NAS.	Consequences beyond the NAS.
T4 Memory poisoning (including spread across roles)	Provenance and taint; quarantine; autoload only when reviewed; rollback.	Recognize facts that are wrong but look plausible.	Poison that a reviewer lets through.
T5 Stolen or replayed leases	Short TTL; revocable; optional holder binding (DPoP, mTLS).	Stop abuse within the TTL.	The TTL window.
T6 Approval fatigue and rubber-stamping	Rare gates; the NAS renders the diff; approvals bound to a digest; approval rate monitored.	Make people look carefully.	Human error.
T7 Log tampering	Hash chain; optional external anchoring.	Without anchoring, stop root from destroying the log.	A malicious administrator.
T8 Data exfiltration (egress, sharing, search results)	Egress needs a lease action and a gate; `secret` may not leave; derivatives inherit labels.	Prevent leaks after a person approves; covert channels.	Leaks after approval.
T9 Supply chain (skills, MCP servers, plugins, models)	Content of skills and external MCP servers is treated as `external`; a skill directory can be pinned to a commit; the runtime manifest is written to the record.	Guarantee that third-party code is harmless.	A pinned malicious version.
T10 Resource exhaustion (branch bombs, exhausted budgets, read loops)	Quotas; TTLs; budgets; circuit breakers.	Tell a legitimate large task from a runaway one.	Local denial of service.

Controls

Policy engine: deterministic (Cedar or Rego style), deny by default, and on denial it gives a readable reason and the rule that matched; it does not call an LLM.
Credential broker: long-lived keys stay with the broker; it mints short-lived downstream tokens for a run only inside an approved egress action.
Isolation and keys: one Home and path space per role; the sensitive retention class uses a separate key domain.
Supply chain: the content of skills, MCP servers and plugins is treated as external; at the start of a run, the skills and versions used are written to the record.

Honest limits

This is not a defence against prompt injection. It limits the consequences and makes them visible.
Legitimate permissions inside a lease can still be misused.
It can do nothing about side effects outside the NAS: an email already sent, an API already called.
Covert channels and side channels are out of scope.
If the TCB is compromised, the guarantees fail.
People make mistakes: gates lower that risk but cannot remove it.
Taint is conservative and brings friction and false positives; it needs tuning and visible denial reasons.
Crypto-shredding only protects the copies we control.

Incident response

Circuit breaker: revoke_run and revoke_role revoke leases at once and freeze the branch.
Rollback: restore the affected tree to an earlier commit.
Trace: use the read manifest and the record chain to find what a run read, what it wrote and which notes it touched.
Clean-up: use Cascade Forget to delete the affected derivatives, and issue a report.

Observability and audit

Three kinds of data: the record (events), the read manifest (the set of inputs), and metrics and traces.
**explain(commit):** returns which run and lease produced a commit, which gates it passed, what was read, and the inputs it depends on.
Integration with existing observability: a run maps to one OpenTelemetry GenAI span, with leases and gates attached as events; records can be exported as JSON Lines or fed to a SIEM.
Metrics: lease issuance and denial rates; gate queue length, approval rate and approval latency; branch count and age; index freshness; budget consumption; record-chain verification results.
Privacy and retention: by default only metadata is recorded, never content; retention of records and deletion of content are independent; reading the record itself needs a lease.

Cite this page

Stable addresses and a suggested citation for people, search engines and agents.

Canonical URL: https://agentnas.com/security/
Markdown version: https://agentnas.com/security/index.md
Suggested citation: Agent NAS project. “Security.” agentnas.com, 2026-11-11. https://agentnas.com/security/

Scope and trust assumptions #

The Rule of Two: a session invariant #

Threat model #

Controls #

Honest limits #

Incident response #

Observability and audit #