Agentic systems increasingly run user-authored orchestration code that invokes tools, spawns subtasks, and delegates work across machines and clouds. Although this high agency is productive, it creates a security problem: identity, authorization, provenance, and delegation are often pushed into application code, where they become difficult to enforce consistently and difficult to audit. We present Grimlock, an Agent Guard that restores separation of concerns by moving trust enforcement into the sandbox substrate while leaving agent code unchanged. Grimlock uses eBPF-enforced traffic interception to ensure that sandbox communication passes through a guard, and combines it with post-handshake attestation bound to standard TLS~1.3 channel bindings. After a channel is established, the guard authorizes communication and mints short-lived, channel-bound scope tokens that capture least-privilege delegation. At the receiving side, the destination guard re-validates identity, scope, and channel binding, terminates TLS, and releases plaintext to the destination sandbox only after policy checks succeed. kTLS provides an efficient dataplane for protected communication. As a result, Grimlock offers a path toward transparent, auditable, and scope-bound agent-to-agent communication across heterogeneous multi-cloud environments, using commodity Linux primitives and without requiring changes to user-layer orchestration code.

翻译：摘要：代理系统日益广泛地执行用户编写的编排代码，这些代码调用工具、生成子任务并将工作跨机器与云环境进行委派。虽然这种高自由度提升了效率，但也引发了安全问题：身份认证、授权、溯源及委派等机制常被嵌入应用层代码，导致难以实施一致性的强制策略与审计。本文提出Grimlock——一种代理防护装置，通过将信任强制机制迁移至沙箱底层基础设施，在保持代理代码不变的前提下重构关注点分离原则。Grimlock利用eBPF实施的流量拦截确保沙箱通信必须经过防护装置，并结合基于标准TLS 1.3信道绑定的握手后认证机制。信道建立后，防护装置对通信进行授权，并生成绑定信道且具有时效范围的凭证令牌，实现最小权限委派。在接收端，目标防护装置重新验证身份、作用域及信道绑定信息，终止TLS会话，仅当策略检查通过后方将明文释放至目标沙箱。kTLS为受保护通信提供高效的数据平面。最终，Grimlock利用通用Linux原语，在无需修改用户层编排代码的前提下，为异构多云环境下的透明化、可审计且作用域受限的代理间通信提供了可行路径。