# Security

> Agent NAS does not stop prompt injection; it limits what happens after one. A narrow lease bounds what a run can touch, branches make mistakes undoable, the Rule of Two stops a session that read untrusted content from also holding sensitive data and an outbound channel, and a traceable record is left behind.

## Scope and trust assumptions

- **What we protect:** the data and history in the NAS; the boundary of authority; the integrity of the record; the traceability of memory.
- **What we do not protect:** what an agent does outside the NAS; isolation of the compute itself (that is the sandbox’s job); anything that happens on the model provider’s side.
- **Trust assumptions:** the trusted computing base (TCB) is the NAS gateway, the policy engine and the record service; the host is not compromised; the sandbox isolates compute. If the TCB is compromised, the guarantees on this page no longer hold.

## The Rule of Two: a session invariant

Three properties: **[A]** the session has read untrusted content, **[B]** the lease allows reading sensitive data, **[C]** the lease allows changing protected state or communicating outward. When all three hold in one session, the call that triggers C is not let through automatically.

| Scenario | A | B | C | Result |
| --- | --- | --- | --- | --- |
| Summarize a web page into a note on the branch | Yes | Yes | No (branch only) | Automatic: a write inside the branch does not count as C. |
| After reading a web page, propose a merge into `main` | Yes | Yes | Yes | Human Gate. |
| Read public data only, write to a scratch area | Yes | No | No | Automatic. |
| After reading an external email, send an email (egress) | Yes | Yes | Yes | Gate; refused if `secret` is involved. |

This is Meta’s [Agents Rule of Two](https://ai.meta.com/blog/practical-ai-agent-security/) implemented at the **storage boundary**. Meta itself stresses that it is a heuristic for reducing risk, not an end point, and no substitute for least privilege; we use it the same way. The mechanism is in [Trust Labels](https://agentnas.com/concepts/trust-labels/).

## Threat model

| Threat | What the NAS can enforce | What the NAS cannot do | Residual risk |
| --- | --- | --- | --- |
| T1 Indirect prompt injection (via files, web pages, email) | The Rule of Two; lease scoping; branches; gates. | Stop an injection from happening, or stop malicious behaviour within the lease after one. | Misuse inside the lease. |
| T2 Credential leakage (an agent reads a long-lived key) | Long-lived credentials are never in a run’s hands; a secret scanner marks `secret`; short TTLs. | Stop an agent sending data within its lease to an authorized egress. | Data leaving within the lease. |
| T3 Over-broad permissions and mistakes | Narrow leases; branches; soft delete; snapshots outside every lease. | Undo side effects outside the NAS. | Consequences beyond the NAS. |
| T4 Memory poisoning (including spread across roles) | Provenance and taint; quarantine; autoload only when reviewed; rollback. | Recognize facts that are wrong but look plausible. | Poison that a reviewer lets through. |
| T5 Stolen or replayed leases | Short TTL; revocable; optional holder binding (DPoP, mTLS). | Stop abuse within the TTL. | The TTL window. |
| T6 Approval fatigue and rubber-stamping | Rare gates; the NAS renders the diff; approvals bound to a digest; approval rate monitored. | Make people look carefully. | Human error. |
| T7 Log tampering | Hash chain; optional external anchoring. | Without anchoring, stop root from destroying the log. | A malicious administrator. |
| T8 Data exfiltration (egress, sharing, search results) | Egress needs a lease action and a gate; `secret` may not leave; derivatives inherit labels. | Prevent leaks after a person approves; covert channels. | Leaks after approval. |
| T9 Supply chain (skills, MCP servers, plugins, models) | Content of skills and external MCP servers is treated as `external`; a skill directory can be pinned to a commit; the runtime manifest is written to the record. | Guarantee that third-party code is harmless. | A pinned malicious version. |
| T10 Resource exhaustion (branch bombs, exhausted budgets, read loops) | Quotas; TTLs; budgets; circuit breakers. | Tell a legitimate large task from a runaway one. | Local denial of service. |

## Controls

- **Policy engine:** deterministic (Cedar or Rego style), deny by default, and on denial it gives a readable reason and the rule that matched; it **does not call an LLM**.
- **Credential broker:** long-lived keys stay with the broker; it mints short-lived downstream tokens for a run only inside an approved egress action.
- **Isolation and keys:** one Home and path space per role; the `sensitive` retention class uses a separate key domain.
- **Supply chain:** the content of skills, MCP servers and plugins is treated as `external`; at the start of a run, the skills and versions used are written to the record.

## Honest limits

1. This is **not** a defence against prompt injection. It limits the consequences and makes them visible.
2. Legitimate permissions inside a lease can still be misused.
3. It can do nothing about side effects outside the NAS: an email already sent, an API already called.
4. Covert channels and side channels are out of scope.
5. If the TCB is compromised, the guarantees fail.
6. People make mistakes: gates lower that risk but cannot remove it.
7. Taint is conservative and brings friction and false positives; it needs tuning and visible denial reasons.
8. Crypto-shredding only protects the copies we control.

## Incident response

- **Circuit breaker:** `revoke_run` and `revoke_role` revoke leases at once and freeze the branch.
- **Rollback:** restore the affected tree to an earlier commit.
- **Trace:** use the read manifest and the record chain to find what a run read, what it wrote and which notes it touched.
- **Clean-up:** use [Cascade Forget](https://agentnas.com/concepts/cascade-forget/) to delete the affected derivatives, and issue a report.

## Observability and audit

- **Three kinds of data:** the record (events), the read manifest (the set of inputs), and metrics and traces.
- **`explain(commit)`:** returns which run and lease produced a commit, which gates it passed, what was read, and the inputs it depends on.
- **Integration with existing observability:** a run maps to one OpenTelemetry GenAI span, with leases and gates attached as events; records can be exported as JSON Lines or fed to a SIEM.
- **Metrics:** lease issuance and denial rates; gate queue length, approval rate and approval latency; branch count and age; index freshness; budget consumption; record-chain verification results.
- **Privacy and retention:** by default only metadata is recorded, never content; retention of records and deletion of content are independent; reading the record itself needs a lease.

---

Canonical URL: https://agentnas.com/security/
Updated: 2026-11-11 · Draft specification v0.2 · CC BY 4.0