Constitutional software: hard guardrails that contain AI agents.

An AI agent that writes and runs code, or that executes tool calls, needs somewhere to run them. The hard guardrail is to give it a dedicated, disposable isolation boundary — a microVM or a user-space kernel — that sits between the agent and the host. Firecracker gives each workload its own guest kernel through hardware virtualization (KVM), booting in roughly 125 ms with under 5 MiB of overhead. gVisor interposes a user-space kernel (the "Sentry") that intercepts every system call the agent makes and re-implements it before it can reach the host kernel.

Inside the boundary the agent cannot see the host filesystem, other tenants, the orchestrator's credentials, or the internal network, because those objects are not present to be reached. The isolation is a property of the processor's virtualization extensions and the host's syscall surface — not of the agent's intentions.

On a bare-host or Docker-only deployment, the blast radius of one successful agent exploit is effectively unbounded. Behind a microVM, it is a single throwaway guest that is destroyed when the task ends. As the field states the principle plainly: the purpose of sandboxing is to constrain the blast radius, not to make the agent trustworthy.

A prompt-injected agent that decides to read another customer's data, scan the internal subnet, or run rm -rf / is operating inside a kernel that does not contain those objects to reach. No amount of model reasoning crosses the virtualization boundary, because crossing it is not an action exposed to the guest.

Data exfiltration and command-and-control are the dominant ways a compromised agent turns a local failure into an organization-wide one, and both require an outbound request. An egress allowlist proxy enforces default-deny on all outbound traffic: the agent may reach only an explicit list of approved destinations, and a separate companion proxy — un-bypassable, pinned with Kubernetes NetworkPolicy or iptables so the internet is reachable only through it — mediates every connection.

A modern agent firewall goes beyond domain matching into content inspection: data-loss scanning of request bodies for API keys and tokens (including base64-encoded secrets), SSRF blocking, MCP-protocol awareness, and per-domain rate limiting. Open implementations include pipelock, which mediates HTTP/MCP/A2A/WebSocket traffic and emits mediator-signed action receipts, and GitHub's gh-aw-firewall.

The control sits at the network layer, outside the agent's process, where no model reasoning or injected instruction can route around it. The April 2026 CSA/SANS/OWASP "AI Vulnerability Storm" briefing lists egress filtering as the first hardening control.

An agent driven by an injected instruction to "send the customer table to this URL" issues an outbound request that the proxy evaluates against the allowlist and content rules and drops. The decision is rendered on the wire, not by the agent; the destination simply is not reachable from inside the boundary.

A long-lived, broadly scoped API key in an agent's environment is the single point that turns one agent compromise into an organization-wide one. The hard guardrail removes standing privilege entirely. A credential broker issues task-scoped, short-lived tokens — typically a 5-to-15-minute lifetime — cryptographically bound to the agent's identity using DPoP (RFC 9449), so a token lifted from memory or logs cannot be replayed by anyone else.

The agent authenticates once; the broker then mints a fresh credential per task, scoped to exactly the resources that task requires, and that credential expires almost immediately. Scope and lifetime are enforced by the identity provider and the resource server at validation time — outside the agent. Implementations include Aembit, Scalekit, Microsoft Entra Agent ID, and Okta/Ping delegation gateways.

This is the "confused deputy" problem stated in identity terms: an agent that can be tricked into acting must not carry credentials whose power exceeds the task in front of it.

A compromised or jailbroken agent cannot widen its own scope or extend its own token — those are not powers it possesses; they belong to the broker and the resource server. A stolen token is bound to a different identity and expires within minutes, collapsing the window and the reach of any credential theft.

A probabilistic agent can enter a tool-calling loop, recursively fork sub-agents, or be driven by a malicious prompt to burn spend or hammer a downstream API. The hard guardrail is a budget enforced in front of the model. Token-budget software such as Waxell enforces hard cost ceilings at the infrastructure layer — per session, per agent, or fleet-wide — evaluated before each call completes, not reported after. Combined with provider-side rate limits and concurrency caps, this bounds consumption per unit time.

The distinction that makes it physics is placement and timing: the check sits in the request path and fails closed. When the ceiling is reached, the next call is rejected at the gate. This is the difference between a fuse and a monthly invoice — the fuse breaks the circuit before the load does damage; the invoice tells you afterward.

It is the direct answer to the thesis's latency problem: the limit is decided in advance and enforced at machine speed, with no human in the millisecond loop.

A runaway agent cannot vote itself more budget. When it crosses the threshold it is halted by the gating layer regardless of what its plan says next, because the enforcement point is outside the agent and evaluates before the action is allowed to proceed.

The most direct containment of an agent's reach is to put a policy decision point in front of every tool call. Following the OWASP model, the agent starts with zero tool access and earns an explicit allowlist. An external authorization engine — Open Policy Agent or Oso — evaluates each requested action against signed policy and returns allow, constrain, queue-for-approval, or deny. Actions are sorted into risk tiers (from L0 arithmetic to L3 external financial transactions); higher tiers require a human signature, and a per-identity kill switch can hard-stop the agent by blocking all tool calls and egress.

Deny-by-default means a capability the policy never granted does not exist for the agent. Irreversible or high-blast-radius actions — deploy to production, wire funds, delete data, grant access — are blocked unless an explicit, out-of-band authorization is present.

The decision is rendered by a separate engine evaluating the request and its tier, not by the model deciding whether to comply. A jailbroken agent asking to wire two million dollars receives the same deny as a well-behaved one.

The gate evaluates the action and its risk tier, not the agent's stated intent, so persuasion does not move it. The known failure mode, named directly by recent analysis: the policy and the kill switch must be authored and held outside the agent's writable scope. If the agent can edit the policy, it is no longer physics — which is exactly the thesis's point that constitutional actors retain authority over the constraint regime itself.

When agents transact across trust boundaries — moving funds from a treasury, settling a payment, executing an on-chain action — perimeter controls inside one operator's infrastructure are not enough, because the counterparty cannot see or trust that perimeter. The hard guardrail here is multisignature authorization: a transaction is valid only if at least m of n designated keys sign it. The threshold is enforced by the protocol that validates the transaction, not by any participant's good behavior.

The canonical implementations are exact software: Safe (formerly Gnosis Safe), the dominant m-of-n smart-contract wallet on Ethereum, which holds a large share of on-chain treasury assets; Bitcoin P2SH/P2WSH multisig (BIP-11, BIP-16), where the script itself encodes the signing threshold; and threshold-signature / MPC schemes (e.g. Fireblocks, ZenGo-style TSS) that split a single key into shares held by separate parties.

Placed around an AI agent, multisig makes the agent one signer among several. It can propose and co-sign, but the funds do not move until the threshold — which can require an independent service or a human co-signer — is met. The constitution is the wallet contract; the agent holds bounded authority within it.

A fully compromised agent holding one key still cannot move the asset: a transaction below the threshold is rejected as invalid by every validating node, the same way a vault with two physically separate locks will not open with one key turned. Authorization is a property of the signed transaction checked by the network, not a permission the agent can assert.

The foundational guarantee of a blockchain is negative: the same unit of value cannot be spent twice, and a settled transaction cannot be quietly reversed. This is enforced not by a trusted operator but by distributed consensus over deterministic validation rules — the mechanism the original Bitcoin paper introduced specifically to solve double-spending without a central authority.

The exact mechanisms are well-defined. Bitcoin's UTXO model marks each output as spent or unspent; every node independently rejects any transaction that references an already-spent output, and Nakamoto (proof-of-work longest-chain) consensus determines the single canonical ordering. Account-based chains such as Ethereum enforce a strictly increasing per-account nonce that makes replay and reordering invalid, and modern BFT finality gadgets (Tendermint/CometBFT, Ethereum's Casper-style finality) make a confirmed block economically irreversible.

For AI containment, this is the substrate of verifiable, non-repudiable, non-duplicable agent actions. When an agent's commitments are settled on such a ledger, no quantity of agents — honest, buggy, or adversarial — can double-pay, replay, or silently undo a settled action, because the contradictory state is rejected by the validation rules every participant runs.

Double-spending is not a permitted action that policy declines to grant; it is a state the protocol's validity rules render unreachable. A transaction that spends an already-spent output is rejected by every honest node as malformed. The guarantee holds against an adversarial participant precisely because it does not depend on any participant's honesty — only on the validation rules and the economic cost of overturning settled history.