Skip to content
1Claw Academy
Curriculum/The AI Agent Threat Model2 minBeginner · Lesson 12 of 14

Designing the defense: the control plane pattern

Assemble the whole track into an architecture, and see the shape 1Claw implements.

The conclusion of this track is architectural. Since the model cannot be made reliably obedient, the surrounding system must make disobedience survivable. That system is a control plane sitting between the agent and everything valuable.

  • The agent holds an identity, not credentials.
  • That identity is short-lived, audience-bound, and revocable.
  • Every action is authorized against a deny-by-default policy at the moment it is attempted.
  • Credentials for external systems are injected server-side, never handed to the agent.
  • Key material is non-exportable, in hardware, optionally split so no single party holds it.
  • High-impact actions are held for a human, with step-up authentication proportional to risk.
  • Everything is attributable after the fact.
Tip

Read that list against the previous track. Every item is one of those primitives applied to a principal that can be talked into things. That is the whole design.

Map it back to the lethal trifecta and the value becomes concrete. Brokered execution shrinks the private-data circle, because the agent holds no credential to steal. Host and path allowlists constrain the external-communication circle. Untrusted content remains, you cannot remove it and stay useful, but with the other two circles reduced, a successful injection has far less to work with.

Two properties are worth stating plainly, because they are what distinguishes a real control plane from a wrapper:

  • Enforcement lives outside the agent. A control the agent could disable by being convinced is not a control.
  • Compromise is assumed. The question is never whether the agent can be manipulated, only what it yields when it is.

Audit this configuration

A deployment agent runs in CI. It has no vault credentials at all: every external call goes through an Execution Intents binding, so credentials are injected server-side and the agent never sees one. Does brokered execution close the trifecta on its own?

For each capability, mark every circle it contributes. Some contribute none.

  • read_pr_description

    Reads the pull request title and body to decide what to deploy.

  • execute:deploy-api

    Calls the deploy API through a binding. The credential is injected server-side and never enters the agent's context.

  • execute:fetch-config

    Reads deployment config through a binding scoped to one host and one path.

  • read_build_logs

    Reads the CI build logs for the current run.

Watch out

A system prompt saying 'never reveal secrets' is not a control. It is a preference expressed to a component that takes instructions from whatever is in its context: including the attacker's.

The remaining tracks build this concretely with 1Claw: vaults and envelope encryption for storage, agents as first-class principals with scoped policies, Execution Intents so credentials stay server-side, Shroud for TEE-protected inspection, graduated HITL for approvals, and an audit trail across all of it. You now have the vocabulary to evaluate those choices rather than just follow the steps.

Check your understanding

3 questions
1

What distinguishes a real control plane from a system prompt instruction?

2

Which circle of the lethal trifecta does brokered execution primarily shrink?

3

Why is 'untrusted content' the circle you generally cannot remove?