The Warden Agentic Runtime Reference Architecture for security leaders

The Warden is a runtime guard around an AI agent, and it is not an agent itself. It stops each action the agent wants to take, called a tool call intent, before the action happens, and decides what actually runs.

“It is runtime enforcement: sitting around the agent, intercepting every tool call intent before it executes, and governing what actually runs.”

The model is treated as unpredictable and untrusted. The Warden is the opposite: it is deterministic and it enforces. Without it, the model has unrestricted authority to act.

“The model is non-deterministic and untrusted. The Warden is deterministic and enforced. The model generates outputs. A model without the Warden has unrestricted execution authority.”

The author uses the 10 Control Planes framework as the lens. It maps what an agent can touch in a real company. The finding that matters here is where the risk sits: between the planes, not inside the model.

“risk concentrates in the transitions between planes, not in the model itself”

The Warden is six functions in sequence inside one boundary: Admittance, Interrogation, Classification, Rules, WatchTower and Judge. Each can be deployed alone, and the outer ones make up for gaps in the inner ones. This course takes them in turn.

“Six distinct functional components arranged in sequence: Admittance, Interrogation, Classification, Rules, WatchTower, and Judge. Each function is independently deployable. Outer functions compensate for gaps in inner ones.”

Most agents hold one credential that lasts a long time and covers a lot, set up once and trusted to last. If the agent drifts, is hijacked by an injection attack, or its session is compromised, it inherits everything that credential can reach.

“In most agentic deployments that credential is long-lived and broadly scoped, provisioned once at setup and trusted to last, which means a single failure event can reach everything the agent can reach.”

Admittance replaces that with a credential made for one task. The token lists each tool the task may use, and a tool that is not on the list cannot be called, whatever the model asks for.

“Admittance issues ephemeral credentials scoped to a single task.”

“Each tool the task is permitted to invoke appears in the token scope. Tools not in scope cannot be invoked regardless of what the model requests.”

A timestamp alone is not enough. A stale token string can stay in the model's context window and be replayed by a sub-agent further down the chain. Rotating the key makes that string worthless the moment the task ends.

“This closes a specific failure mode: stale token strings retained in LLM context windows could be replayed by downstream sub-agents if only timestamp invalidation were used.”

“The HMAC slot mechanism makes the token cryptographically unverifiable the moment the task completes, regardless of what residual token text the model remembers.”

Admittance also keeps a trust score for agents dealing with each other. The score falls when an agent behaves oddly, and it decides whether an agent may start sub-agents at all. Trust is earned by observed behaviour, not handed out once at setup.

“A delegating agent's trust score gates whether it can spawn sub-agents at all. Static binary trust does not capture the reality of agent behavior over time.”

“This mechanism makes trust a dynamic property earned through observed behavior rather than granted at identity provisioning.”

A task can wander a long way from its goal through steps that are each allowed. Checking one action at a time cannot see that. Interrogation is built to.

“A session can walk far from its original objective through a sequence of individually permitted steps, each one passing policy, the cumulative direction compounding away from where the task started.”

“Policy evaluated per-action has no way to see that.”

Every action the model proposes is compared with the anchor on two independent channels. Both must say allow. One deny or step-up from either channel is enough to block the action.

“Every tool call intent the model produces is evaluated against that anchor using two independent channels. Both channels must return ALLOW for the intent to proceed. Either channel returning DENY or STEP_UP blocks execution.”

One channel keeps a rolling trajectory score. It adds up how far the session has moved from the anchor, so many small steps still add up. Judging each step alone can be beaten by keeping every step just under the limit.

“Channel A maintains a rolling trajectory score: the cumulative cosine distance between the current session vector and the intent anchor.”

“Per-step delta scoring can be evaded by keeping each step just under threshold while the aggregate trajectory drifts arbitrarily far.”

The model that produces the embeddings has to be pinned and versioned. An update changes the space the scores live in, so scores from before and after cannot be compared. Treat it like a cryptographic component and put it under supply chain controls.

“A model update changes the embedding space and makes trajectory scores from before the update non-comparable to scores after it.”

“The embedding model is a trust infrastructure component subject to supply chain controls, the same rigor applied to cryptographic primitives.”

Prompt injection, bad tool output and memory poisoning share a pattern. The agent acts on an instruction from an untrusted channel, and the action itself looks ordinary. Judging the action alone leaves that hidden. Classification looks at where the instruction came from.

“Prompt injection, malicious tool outputs, and memory poisoning all work the same way: the agent acts on instructions from an untrusted channel while the action itself looks ordinary.”

“The triggering instruction's origin is what makes the risk visible, and that's what Classification tracks.”

Classification gives two outputs, an action risk tier and the trust level of the source. Both go into Rules.

“It produces two outputs: action risk tier and source provenance trust. Both feed into Rules policy evaluation.”

Reversibility matters most for the risk tier. Deleting data, revoking credentials, moving funds or sending data out cannot be undone, so they are treated differently from reversible actions.

“Reversibility is the primary factor in risk classification. An irreversible action, data deleted, credentials revoked, funds transferred, data exfiltrated, is categorically different from a reversible one.”

Source trust has five tiers, highest first:

• A trusted, authenticated person giving direct input
• A validated tool output from a trusted source
• A document retrieved from an indexed internal corpus
• A tool output from an external source
• Persistent memory

“Source provenance verification tracks five trust tiers from highest to lowest: trusted authenticated principal (direct verified user input), validated tool output from a trusted source, retrieved document from an indexed internal corpus, tool output from an external source, and persistent memory.”

When an action rests on several inputs, it takes the trust of the least trusted one. Trust also stays with the action: content that began untrusted does not become trusted by going through a review cycle. Trust is a property of origin, not process.

“When an intent is derived from multiple inputs, the recorded source trust is the least-trusted contributing source. This is the weakest-link rule.”

“An action that originated from untrusted retrieved content does not gain trust by passing through a deferral cycle. Trust is a property of origin, not process.”

Rules enforces policy at the moment a tool is called. Its property is that the same inputs always give the same decision. Interrogation judges meaning and context. Rules gives the guarantee Interrogation cannot.

“The property that matters: identical inputs always produce identical decisions. This is the contrast to Interrogation's semantic and context-dependent evaluation.”

“Rules provides the identical-inputs-identical-outputs guarantee that Interrogation cannot.”

Rules also counts calls over time. Those counters must sit in a strongly consistent store. If they are read from an asynchronous log, two calls made at the same moment can both pass the count check before either is recorded.

“If temporal sequencing state is read from an asynchronous event log, two concurrent tool call intents can both pass the count check before either one commits to the ledger.”

“Temporal sequencing counters must live in a strongly consistent atomic store, not in an asynchronous telemetry bus.”

Rules can return more than yes or no. The decision types include:

• Allow or deny the action
• Modify: allow it with changed parameters, such as a narrower query or a redacted field
• Defer or step up: send it to a human
• Defer expired: no one answered in time
• Suspend: end the session

“Decision types: ALLOW, DENY, MODIFY, DEFER, STEP_UP, DEFER_EXPIRED, SUSPEND.”

“MODIFY allows Rules to return an action as permitted but with parameter modification before execution: restricting a query to a permitted scope, redacting a field from an output payload.”

“reviewer does not respond within the extension window (DEFER_EXPIRED).”

“SUSPEND terminates the session immediately when a pattern of repeated threshold violations is detected across a session.”

Suspend is a circuit breaker. It fires on a pattern of repeated violations that points to systematic boundary testing, not on a single action over a limit. It revokes the token and flags the agent for trust review.

“SUSPEND terminates the session immediately when a pattern of repeated threshold violations is detected across a session.”

“This is a circuit breaker response to systematic anomalous behavior, not a response to individual actions.”

“SUSPEND revokes the token and flags the agent identity for trust score review at Admittance.”

Judge is the human gate. Some actions are allowed by policy but wrong in context, and blocking everything uncertain is the wrong answer to ambiguity. Judge takes the escalations, pauses the agent, asks a person and records a signed receipt of the outcome.

“Some actions are technically permitted but contextually wrong, and a hard block is the wrong response to ambiguity.”

“Judge handles escalation decisions from Interrogation and Rules, routes them to a human reviewer, suspends execution, and emits a signed receipt on resolution.”

An approval must bind to what the reviewer saw. A bare approved flag does not, because anything that can write to the review store could set it, and an approval given for one set of arguments could be applied to a different call.

“An approval has to bind to what the reviewer saw.”

“A bare approved flag does not: anything that can write to the review store could set it, and an approval given to one set of arguments could be applied to a different call.”

WatchTower collects events from every control plane, matches them to a session and raises anomaly signals that no single plane's tool can produce alone. This is where the 10 Control Planes idea becomes operational inside the Warden.

“The WatchTower is based on collecting events across all 10 control planes, correlating them per session, and producing anomaly signals that no individual plane's tool can produce alone.”

It does not trust clocks for ordering. Each event producer signs its events and numbers them in sequence, and the sequence number decides the order. Changing a field after signing breaks the signature.

“The correlation engine uses sequence numbers as the authoritative ordering signal. Timestamps remain for human readability but are not trusted for security ordering.”

“Any post-signing field alteration invalidates the signature at ingestion.”

Two signals catch slow, quiet data theft:

• Payload entropy: a small input that produces a large, information-rich output is a warning sign, however long it took
• Sensitivity crossings: each move to a higher classification tier than the last action; three or more in a session is a high-anomaly signal

“High-entropy output from low-entropy input is an exfiltration signal. This fires independently of velocity to detect slow-moving exfiltration.”

“Three or more crossings in a session is an automatic high-anomaly signal.”

The article is direct about four things the Warden does not solve:

• The model's reasoning cannot be inspected, so an injection can go unseen even when its effects are caught
• Activity that crosses session families with no linked lineage leaves no signal
• Bugs inside the tools themselves
• Tracing an action to one source is probabilistic once the model has blended inputs

“The model's reasoning chain is not inspectable. Interrogation evaluates the tool call intent the model produces, not the reasoning that produced it.”

“activity that crosses session families with no lineage linkage produces no signal within the Warden.”

“the Warden constrains tool invocation. It cannot prevent bugs or malicious behavior within tool implementations themselves.”

“causal attribution between a specific source and a specific tool call intent is probabilistic.”

Knowing these limits is part of using the design well. They tell you where to put other controls.

There are three ways to deploy. SDK instrumentation embeds the Warden in the agent's orchestrator and suits teams that control the agent code. A protocol gateway acts as a proxy in front of the tools and suits teams that control the network but not the code.

“SDK instrumentation is recommended when the implementer controls the agent code. The Warden is embedded as middleware in the orchestrator process.”

“Protocol gateway is recommended when the implementer controls the network but not the agent code. The Warden operates as an MCP proxy.”

Most enterprises should layer them. The SDK checks come first for context and drift. A gateway covers protocol-based tools where the code cannot change. Kernel-level eBPF is a backstop that is hard to bypass for forbidden actions.

“Layered deployment is the production posture for most enterprise environments.”

“SDK instrumentation as the primary enforcement layer for semantic context and intent drift detection. Gateway as secondary for protocol-based tools and consistent enforcement across agents where SDK modification is not feasible. eBPF at the kernel level as a bypass-resistant backstop for forbidden action enforcement.”

The build sequence starts with what removes the most risk soonest:

• Stage 1: Rules only. Forbidden actions, scope violations and count anomalies
• Stage 2: add Admittance. Task-scoped credentials limit the blast radius
• Stage 3: add Interrogation and Classification. Drift detection and provenance-weighted risk
• Stage 4: add WatchTower. Cross-plane correlation; it detects but does not prevent
• Stage 5: add Judge. A human gate; full runtime governance

“Stage 1: Rules only. Point-in-time policy enforcement and temporal sequencing at the tool call boundary. Catches forbidden actions, scope violations, and session-level count anomalies.”

“Stage 2: Admittance plus Rules. Adds JIT token scoping and cryptographic zeroing on task close. Per-task blast radius containment.”

“Stage 3: Interrogation, Classification, Admittance, Rules. Adds intent drift detection via rolling trajectory scoring and provenance-weighted risk tiers.”

“Stage 4: WatchTower. Adds cross-plane correlation and velocity/entropy anomaly detection. Detection, not prevention.”

“Stage 5: Judge. Adds human gate for step-up authorization. Full runtime governance.”

Plan to calibrate. The drift thresholds and the review window are defaults. Tune them against real sessions and real reviewer response times, or reviews can expire and tasks restart in a loop.

“The warn/defer/deny thresholds (0.35/0.55/0.75) are defaults requiring tuning against real session trajectories before they function as meaningful controls.”

“For workflows where STEP_UP is expected frequently, calibrate the extension window against observed reviewer response latency to avoid operational deadlock from DEFER_EXPIRED task re-initiation loops.”

A partial deployment still gives real governance, because each function can stand alone.

“a partial Warden deployment still provides meaningful governance, and the build sequence reflects which controls deliver the most blast radius reduction earliest”