15 articles | AI platform / Security engineering
Architecture Notes
How OSuite primitives turn agent activity into governed runtime structure.
How OSuite governs agent actions: PCAA, CAVA, BAF, and AREG.
Final authority, canonical action identity, bounded authorization, and exposure evidence: the current control path and the limits of the proposed BAF/AREG connection.
We tested 6,000 agent actions. Runtime labels were not enough.
OSuite Runtime Boundary Benchmark tests whether an agent action is still inside the boundary that was approved, across 20 runtime surfaces, 38 risk families, 6 locales, and 10 obfuscation styles.
A governed agent action made it from approval to a public ledger to a real GitHub side effect.
OSuite and Baby Blue / invinoveritas ran a v11 registry-scoped reference run: OSuite created a CAVA action artifact, received a signed independent-mediator verdict, self-submitted it to Baby Blue's ledger, executed a real GitHub issue creation, and checked that the outcome still matched the approved action.
Auto mode changes the governance object.
As coding agents move toward longer-running autonomous work, the enterprise control point shifts from whether a model may call a tool to whether the runtime action stays inside an approved boundary.
A governed agent action was independently recomputed outside OSuite.
OSuite and Baby Blue / invinoveritas ran a concrete external-verifier composition: a CAVA action artifact, a partner-signed verdict, and a proof packet that can be checked without trusting either party's internal log.
Runtime Exposure Management is where AI governance becomes operational.
AI governance should not stop at policy language or model posture. For agentic systems, the buyer needs to see what can act, what it can reach, where approval is bounded, and whether exposure is improving.
Why approval must bind to the action, not the text.
A human approval means nothing if a wrapper can rewrite the request after the click. Here is how OSuite makes approval enforceable.
Agent registries are not action proof.
Microsoft Agent 365 is a useful signal for where the market is going. But enterprise agent registries and lifecycle control planes still need an action-boundary proof layer underneath real side effects.
Runtime Coverage is not a parser percentage.
CAVA gives OSuite a stable action language. Runtime Coverage explains how each real agent runtime is mapped into that language.
Matoi: Reuse evidence. Recheck authority.
What remains valid when an agent's environment changes? Matoi studies how to reuse checked consequence evidence without treating it as permission to execute. The research preprint is now on arXiv.
Service access is not payment authority.
A compromised service credential should not become permission to move money. Our controlled tests exposed gaps in an earlier gateway-based design and informed a tighter resource-side execution boundary.
Making the CAVA benchmark claim computable.
A public replication survey initially marked CAVA's benchmark claim as not released. We published the missing reproducibility artifact, and the record was updated to COMPUTABLE after an independent rerun.
Egress is an action boundary: what our controlled study found.
Exact-action grants contained the observed scope violations that destination filtering missed. The same study exposes where revocation, single use and completion guarantees end.
Harness is not runtime governance.
AI agent harnesses help models plan, call tools, and run longer workflows. Enterprise runtime governance answers a different question: what action was approved, what actually executed, and can the proof survive audit?
ZeroGate: agent governance should feel like a tap, not a queue.
Inspired by Suica and FeliCa, we tested what happens when exact-action approval is prepared before dispatch. The whitebook, arXiv paper and reproducible evidence are now available.