Describes the Agent Security Contract (ASC), a deny-by-default, pre-execution authorization gate for agent and MCP tool calls. A policy pins a SHA-256 digest of the approved tool catalog, declares per-agent tool allowlists with argument constraints, marks high-impact tools that need out-of-band approval, and bounds call rates. Every decision (ALLOW, BLOCK, REQUIRE_APPROVAL) is emitted as an integrity-checked JSON evidence envelope, and enumerated error paths resolve to BLOCK. Evaluated on static recorded tool-call traces only — no live agent.
Evidence-Driven Infrastructure Engineering for Kubernetes and AI
Evidence-driven infrastructure engineering for Kubernetes and AI. It asks what evidence you have when terraform plan is clean, CI is green and GitOps reports Synced. Available as paperback and Kindle on Amazon.
