The agent never owns the credential.
Protected workers are credential-starved. Remote authority stays with a broker that grants bounded, attributable actions instead of exposing reusable secrets.
Identity · scoped grants · short leasesSecurity at Mithran
Assume the agent will find a way.
Your agents can be wrong, manipulated, or malicious. Mithran is built so no single model, rule, gateway, or reviewer has to be perfect for the company to stay in control.
The premise
Anything AI does, and anything it produces, is unsafe until independent evidence says otherwise.
Defense in depth
Four boundaries. One continuous record.
Every boundary catches a different class of failure. Together they keep useful work moving without asking the enterprise to trust the agent, the person directing it, or a single control.
The builder does not approve itself.
An independent review path evaluates intent, evidence, policy, and risk before consequential work advances. Unsupported confidence is not a verdict.
Adversarial review · cited policy · typed verdictProtection reaches where the work runs.
For Forge-controlled workloads, isolation and intervention extend into the compute boundary. The runtime is part of the control plane, not a destination beyond it.
Isolated compute · runtime policy · quarantineNo consequential action vanishes.
Requests, grants, decisions, mutations, deployment state, and runtime interventions become linked records that can be replayed and reconciled.
Receipts · provenance · Flight RecorderThe compute boundary
A gateway can only stop the traffic it sees.
An agent can change protocols, spawn another process, call a different tool, or attack the layer enforcing the rule. Real containment needs a boundary the workload cannot rewrite from inside.
Company policy
Broker and review
Runtime boundary
Isolated
compute
compute
01
Start without standing credentials.
A protected worker begins with no reusable cloud or source-control credential it can read or leak.
02
Broker each consequential action.
The system grants the smallest useful authority for the named task, then records what used it.
03
Run inside bounded compute.
The app or agent executes inside a Forge-controlled runtime with declared routes and intervention points.
04
Keep the boundary after approval.
The controls attached during review stay with the workload in production. Approval is not the end of governance.
The trust contract
Every decision must answer six questions.
“The AI approved it” is not an answer. A trustworthy decision exposes what happened and leaves a human with real authority over the result.
What is trying to happen?
The goal, actor, target, scope, and expected business outcome stay attached to the work.
Who tried to prove it wrong?
The reviewer is independent of the builder and cannot inherit the builder’s incentive to finish.
What supports the verdict?
Findings cite policy, system state, assumptions, and the evidence that would falsify them.
What happens next?
Allow, repair, block, or escalate. Missing or indeterminate evidence cannot silently become approval.
Who can override it?
A person can block, approve a scoped exception, change policy, or revoke. Overrides carry an owner, reason, scope, and expiry.
Can we prove it later?
The request, decision, authority, changes, and result remain connected in a signed evidence trail.
Honest security posture
Precise claims are part of the control.
Security copy should have the same evidence bar as the product. We say where the boundary works, where it does not, and what still needs to be earned.
What is evidenced
✓
Credential-starved protected workers
Protected local and hosted sessions have evidence for broker-required remote writes and for denying raw credential material to the worker.
✓
Adversarial bypass exercises
Local isolated-worker and hosted Firecracker paths include bad-script proofs against the named containment boundaries.
✓
Attributable remote authority
Protected source-control and cloud mutations route through typed broker actions or approved command profiles with receipts.
What we do not pretend
!
A fully compromised host is not safe by magic.
Local evidence and policy depend on a surviving trust base. A device that is completely owned can suppress or destroy local signals.
!
Prompt injection is not “solved.”
Mithran reduces authority and blast radius, detects suspicious behavior, and preserves evidence. It does not claim perfect classification.
!
Coverage follows the proved topology.
Runtime protection covers traffic and authority routed through the declared Forge boundary. Alternate routes need their own evidence before they inherit the claim.
The short version: protect what you can prove, expose what you cannot, and never let an unsupported control masquerade as enforcement.
More control should create more freedom.
The point of security is not to slow the agentic enterprise down. It is to let more people build, with a system strong enough to carry the risk.
hello@mithran.ai →