1. Proprietary dual-engine defense line
Reality Kernel secures agentic systems using a two-layer defense architecture, combining static policy-driven limits with deep causal execution modeling:
Engine 1 — Policy-driven least agency
Outer perimeter guard. Verifies workload identity via short-lived scoped tokens and performs static validation against tool, directory, and egress allow-lists before simulation.
Engine 2 — Causal simulation sandbox
Deep consequence checker. Evaluates commands that clear policy checks by simulating system-state trajectories across parallel shadow worlds.
2. Threat modeling & defenses
We assume agentic hosts are highly vulnerable to prompt injection and supply-chain compromise. Our defenses address four primary threat vectors:
Filters commands containing localhost IP space, cloud metadata endpoints (169.254.169.254), or private subnet ranges before execution.
Sanitizes intent parameters and blocks adversarial instructions before they reach downstream shell interpreters.
Checks all outbound network requests against declarative wildcard allow-lists. Unauthorized targets trigger immediate blocks.
Restricts execution privileges using least-agency YAML/JSON scopes. Root or system-config alterations are filtered.
3. Zero Trust alignment matrix
A comparison of Reality Kernel controls to the baselines outlined in Legacy Systems's Zero Trust Architecture for AI Agents whitepaper.
| Zero Trust parameter | Whitepaper baseline | Reality Kernel implementation | Verification baseline |
|---|---|---|---|
| Identity & auth | Static keys deprecated. Workloads must use ephemeral, short-lived scoped tokens. | Session Token Exchange HMAC-signed 1-hour session tokens. | POST /v1/token exchanges master key for scoped session key. |
| Least agency | Restrict tool scopes, paths, and target environments dynamically per action. | Declarative Policies Wildcard binary and egress checking. | policy block processed inside /v1/check. |
| Data retention | Zero retention of prompt text and execution secrets on intermediary nodes. | Zero Retention Logs store hashes and redacted fingerprints. | Database contains only metadata, verdicts, and hashes. |
| Auditability | Verifiable, append-only, tamper-evident audit logs of actions and decisions. | Linked Hash Chains Audit logs linked sequentially via SHA-256. | Interactive cryptographic chain verifier. |
| Isolation boundary | Hardware-backed containment of untrusted execution output. | Sandboxed Simulation Causal shadow worlds model. | SaaS uses synthetic deltas; VPC deploys MicroVM/gVisor. |
4. Trust posture at a glance
Reality Kernel's operational trust surface, one row per commitment: