4 posts in technical paper
Enforcing trust boundaries in a single token stream
A language model reads its system prompt, the user's query, and everything an agent retrieves as one undifferentiated sequence of tokens. There is no privilege separation inside that sequence. This paper argues the boundary must be reconstructed around the model — with provenance on the way in and egress control on the way out — and specifies the runtime checkpoints that do it.
Samuel Oyan — Engineer
Egress inspection for LLM systems: stopping data on the way out
Almost every LLM security control watches what goes into the model. EchoLeak proved the expensive gap is what comes out: sensitive context encoded into a URL, an image reference, or markdown the client will resolve. This paper specifies egress inspection as a first-class checkpoint — what to look for, why it is the hardest link for an attacker to avoid, and how to run it without wrecking latency.
Samuel Oyan — Engineer
Identity-bound execution permits for autonomous agents
An autonomous agent that holds standing privilege is a standing liability: one injection, one logic error, and it acts with everything it was ever granted. This paper specifies an alternative — zero standing privilege plus per-action, identity-bound execution permits — and shows how the same primitive answers both 'can this action run' and 'is this agent allowed to act for this user right now.'
Samuel Oyan — Engineer
Mediating MCP: tool-description integrity and approval-view fidelity
The Model Context Protocol turns tool descriptions, tool results, and configuration into inputs an agent trusts implicitly — and 2026's CVEs proved each one is attacker-reachable. This paper specifies a mediation layer for MCP: inspect metadata before use, close the approval-view fidelity gap, pin against silent swaps, and authorize the call that actually executes.
Samuel Oyan — Engineer
Need something else?
Email support@intertrace.ai with topic requests, or try the Simulation Lab and the documentation hub.