LONG-HORIZON AGENT SECURITY

Track the state.
Contain the capability.

An action can look harmless.
The capability it creates may not be.

Horizon Agent Containment follows what an agent accumulates: data, artifacts, trust, and authority. It evaluates the resulting state before committing a transition.

Explore a scenario Read the source
Research prototypePython 3.10+
PROVENANCE SURVIVES THE TRANSFORMATION

Different artifact.
The same boundary.

  1. Read a secretSource classification: SECRET
  2. Transform. Encrypt. Split.Derived artifacts retain their lineage.
  3. Upload to an external destinationBLOCK · SECRET_TO_EXTERNAL

The hypothetical upload would create a data-exfiltration capability. HAC keeps the committed state unchanged.

Recorded scenario from the Python prototype.Inspect evidence ↗

01 Deterministic engine

02 Persistent lineage

03 Explicit authority

04 Atomic state decisions

01 / THE RESEARCH QUESTION

What can this agent
become capable of?

Risk can emerge from a sequence of legitimate steps. HAC makes the relationships between those steps part of the security decision.

PROVENANCE

Keep the origin attached.

Derived artifacts inherit classification and lineage. Transforming, encrypting, or chunking secret-derived data does not implicitly declassify it.

Inspect provenance logic ↗

CAPABILITIES

Connect the accumulated state.

Derive capabilities from artifacts, destinations, trust, credentials, and graph relationships. Evaluate what the new state would enable.

Inspect capability logic ↗

SECURITY INVARIANTS

Commit inside the boundary.

Evaluate a hypothetical transition first. If a configured invariant fails, discard that state. Explicit delegation and authority remain part of the model.

Read the security model ↗

02 / BEFORE STATE CHANGES

Evaluate the consequence.
Then decide what to commit.

The engine reasons over an explicit model. A trusted integration must represent real effects accurately and honor its decision.

CURRENT STATE + PROPOSED ACTIONHACEngine.evaluate
  1. 01 / VALIDATE

    Check the inputs

    Actor, resources,
    provenance, authority

  2. 02 / MODEL

    Propose a state

    Clone the committed state.
    Apply a hypothetical effect.

  3. 03 / EVALUATE

    Derive capabilities

    Update the graph.
    Check security invariants.

  4. 04 / DECIDE

    Commit or discard

    ALLOW commits.
    BLOCK preserves prior state.

The model defines the boundary. HAC is a research prototype around explicitly represented state. It does not automatically intercept arbitrary tools, replace sandboxing or IAM, or guarantee containment of unmodeled actions.

Read the threat model ↗

03 / EXPLORE THE SCENARIOS

Follow the steps.
Watch the boundary.

These results were recorded from the Python engine. Changing scenarios replays that evidence; no tools or commands execute in the browser.

Read the recorded results ↗

RECORDED PYTHON ENGINE OUTPUT

Data exfiltration

Secret-derived data keeps its lineage through transformation, encryption, and chunking. The external upload is blocked.

BLOCK
  1. 01
    Read resourcesecret-db
    ALLOW
  2. 02
    Create artifactsecret-db → secret-report
    ALLOW
  3. 03
    Transform artifactsecret-report → summary
    ALLOW
  4. 04
    Encrypt artifactsummary → summary.enc
    ALLOW
  5. 05
    Split artifactsummary.enc → chunk-1, chunk-2
    ALLOW
  6. 06
    Upload artifactchunk-1 → public-internet
    BLOCK

FINAL TRANSITION

The external upload is blocked.

Secret-derived data would cross into an external destination.

Detected capability
DATA_EXFILTRATION
Violated invariant
SECRET_TO_EXTERNAL
Committed state
Unchanged by the blocked action

04 / TWO RELATED QUESTIONS

An action boundary.
A capability boundary.

ACB and HAC are independent projects. They investigate different parts of the same problem: how to put meaningful limits around agent behavior.

AGENT CIRCUIT BREAKER

Should this action execute?

Action and trajectory policy checks, with a trusted runtime path for exact approvals and durable local execution state.

Explore ACB ↗

HORIZON AGENT CONTAINMENT

What would the resulting state enable?

Model provenance, authority, and accumulated relationships. Derive capabilities and evaluate invariants before committing a transition.

Inspect the optional ACB bridge ↗

05 / EXPLORE THE IMPLEMENTATION

A research idea.
Working code.

The repository contains the deterministic Python engine, scenario definitions, invariant tests, a Streamlit demo, and conceptual integration adapters.

Repository and setup instructions ↗Inspect the tests ↗

FOLLOW THE DECISION IN THE SOURCE

engine.pyEvaluate, commit, or discard ↗transitions.pyValidate and model effects ↗provenance.pyPropagate data lineage ↗invariants.pyEvaluate the security boundaries ↗

Prototype v0.1.0 · Python 3.10+
Evidence recorded at source revision 639a641.

FROM THE ENGINEER BEHIND THE PROJECT

Powerful systems.
Clear boundaries.

Sagar Chhatrala

Sagar ChhatralaSecurity engineer. Researcher. Open-source builder.

Explore HAC on GitHub More of my work →