synodic-ai AI SECURITY
AI Security Desk · Agent Security · Runtime Enforcement

Taking the Trust Decision Away from the Agent: Screen Regions, System-Boundary Monitors, and Policy-Routed Guards

2026-10-14

Three preprints posted on 2026-10-13 place the security decision for LLM agents somewhere other than the model's own judgment: in deterministic rules over a computer's accessibility tree, in a reference monitor at the agent's isolation boundary, and in a fast classifier that routes each action to the audit policy that applies. Two start from the premise that indirect prompt injection cannot be ruled out by training; the third makes a policy-aware guard fast enough to sit in the action path.

The premise: the model cannot be the boundary

Seip, Markovinović, and Hein state the problem directly: the safety of LLM-based agents currently rests on alignment training and safety classifiers, and neither can rule out that a sophisticated indirect prompt injection goes through and causes significant harm. Recent work has therefore built agents with information-flow guarantees, but those designs rely on structured tool interfaces to interact with the environment.

Hempel, Loose, Cavallaro, and Eisenbarth reach the same position from the side of software development. Agents are given capabilities that let them act with the user's authority on any resource they can access, and that reach is equally available to an attacker who can steer the agent. Anything an agent ingests can carry an injected instruction, and since the model does not reliably distinguish instructions from data, they argue that indirect prompt injection should be mitigated by mediating the effects the agent produces.

Hu, Jing, Shi, Liu, Fan, and Zhang work on the guard itself. Agent harnesses need a low-latency guardrail model together with customizable audit policies, and auto-regressive guardrail models incur high inference latency and are often poorly aligned with customized policies.

SA-CUA: drawing a trust boundary on a screen

Computer-use agents act visually on the screen, which offers no boundary between trusted first-party interfaces and untrusted, potentially attacker-authored content. Actions are just as ambiguous: a click may land on an application toolbar or on a button an attacker controls. The usual fallback, treating the user as the source of trust and confirming each sensitive decision, produces confirmation fatigue and with it the risk that a harmful action is approved.

SA-CUA is a dual-LLM framework that generates a trust boundary for computer-use agents by deriving conservative deterministic rules from the accessibility tree. Those rules unmask trusted regions from the privileged model's screenshot, keeping trusted and untrusted content separated. Human interaction is required only for proper task specification at the start. During the task, an endorsement channel lets values pass from the untrusted to the trusted domain by verifying the information through trusted channels, which lets the agent handle tasks involving untrusted information autonomously. The authors report that SA-CUA maintains much higher utility than CaMeL-CUA, the comparison design they evaluate against.

Kairos: mediate effects, and defer the ones that are still ambiguous

Kairos addresses a structural difficulty with effect mediation. Legitimate work and the first step of an attack often look alike when an individual action is observed, and what separates them lies later in the trace. A monitor limited to allow and deny is forced to decide before the evidence has accumulated.

Kairos is a reference monitor placed at the isolation boundary of an unmodified, opaque agent. At that boundary a tool call, a shell command, and a script the agent writes all appear as the same file and network operations, so confinement holds regardless of how the agent behaves. A declarative policy that states which sources are trusted decides most effects deterministically and defers the rest. Deferred effects are held while the agent continues speculatively, and a decision oracle with bounded authority, such as a language model or a human, releases or refuses each deferred effect in the light of the trace. The authors evaluate Kairos across three benchmarks and three agent models.

Jev-Guard: a policy-aware classifier fast enough for the action path

Jev-Guard is a single model for safety classification and policy routing. The authors construct a policy tree spanning content moderation, cybersecurity, privacy, and legal compliance. Given the caller's audit context, Jev-Guard first navigates the tree to select the applicable audit policy, then performs safety classification conditioned on the retrieved policies.

On 7,033 evaluation cases the authors report 93.72 percent safety accuracy at a mean latency of 58 ms and 93.10 percent hierarchical routing accuracy; the full routing-and-classification pipeline averages 240 ms. Integrated into the Hermes harness framework, its separate permission gate cut mean review time per task from 4.80 s for a fine-tuned LLM judge to 1.33 s across agent trajectories, with no policy violations observed for either guard.

Three placements, three different kinds of guarantee

The designs differ in what they can promise. SA-CUA and Kairos are deterministic for the cases their rules cover: a region derived from the accessibility tree is trusted or it is not, and an effect matched by the declarative policy is allowed or refused without consulting a model. Judgment, human or model, is reserved for what the rules cannot settle, task specification in SA-CUA and the deferred effects in Kairos. Jev-Guard is a learned classifier. At 93.72 percent safety accuracy, roughly six of every hundred evaluation cases were classified incorrectly; its contribution is speed and correct policy selection, not a guarantee.

The two boundary designs also answer the timing problem in different ways. SA-CUA moves verification to the point where an untrusted value crosses into the trusted domain, checking it through a trusted channel. Kairos moves the decision later, holding the effect until the trace shows whether it was the first step of an attack. Both avoid the pattern the authors criticize, a yes-or-no decision made on one action in isolation, whether by a confirmation prompt or by an allow-deny monitor.

What security teams deploying agents can take from this

All three are preprints and the figures are the authors' own, measured on their chosen benchmarks, agents, and baselines. The common lesson is architectural rather than numerical.

Sources