Where control is gained or lost.
Four directions. Every piece of work is labeled, so what is done is never confused with what is planned.
- Published
- Released, with its method.
- Ongoing
- Active, with public code or data.
- Proposed
- Planned. No results claimed.
Action Boundaries
How agents use, and exceed, the authority they are given — and how execution boundaries hold the line.
Q1Which kinds of tool call account for most unauthorized behavior in real sessions?
Q2Can filesystem isolation replace rule matching for the paths that matter most?
Agent Security Gateway
OngoingPolicy enforcement on every tool call, on the developer’s machine.
Agent guardrail benchmark
Published1,652 harmful and 24,911 real tool calls, scored on both.
Taxonomy of authority failures
ProposedHow agents exceed their mandate, drawn from observed sessions.
Human Oversight
Keeping supervision meaningful as agents grow faster and more capable: approval, intervention, reversibility.
Q1How does the quality of human approval change as requests become more frequent?
Q2Can actions be sorted by reversibility, so only irreversible ones need a person?
Transparent refusals
OngoingBlocked actions are reported to the person supervising the agent.
Reversibility classification
ProposedLabeling tool calls by whether and how they can be undone.
Approval fatigue study
ProposedMeasuring how approval accuracy degrades with volume.
Safety Evaluations
Reproducible benchmarks that measure both what a safeguard stops and what it breaks.
Q1How should protection and usability be scored together?
Q2How can others add their own systems to an evaluation without trusting ours?
Agent guardrail benchmark
PublishedGuardrails and policy bundles on harmful and ordinary tool calls.
Shadow AI leak benchmark
PublishedSensitive-data detection on 1,890 real pastes.
Open evaluation harness
ProposedPublishing the harness and public corpora for others to rerun.
Privacy & Accountability
Preventing sensitive data from leaking through AI tools, and keeping records of decisions that hold up to review.
Q1Which sensitive values do general-purpose scanners miss, and why?
Q2How can an audit trail be tamper-evident without leaving the machine?
Shadow AI leak benchmark
PublishedWhere detection fails, including in our own scanner.
PSIRTMap
OngoingVulnerability findings with provenance and human assessments.
Decision record format
ProposedAn open format for actions, decisions and human overrides.
Proposed work is an open invitation.
Working on one of these problems? Let’s talk.