Trust Enforcement Documentation. Aligned with OWASP GenAI Security Project.
Agent Trust & Security
Honest security documentation for security engineers and CISOs
What CapiscIO protects, what it does not, and how we map to OWASP Top 10 for Agentic Applications 2026.
OWASP Agentic Security Coverage
How CapiscIO addresses the OWASP Top 10 for Agentic Applications 2026 threats
| OWASP Risk | Description | CapiscIO Coverage |
|---|---|---|
| AG01: Agent Identity Spoofing | Attacker impersonates a trusted agent | Direct |
| AG02: Tool Misuse | Agents invoke tools with malicious parameters | Partial |
| AG03: Excessive Agency | Agent performs actions beyond intended scope | Direct |
| AG04: Resource Exhaustion | Runaway agents consume excessive resources | - |
| AG05: Insufficient Sandboxing | Agents escape execution boundaries | Roadmap |
| AG06: Communication Tampering | Inter-agent messages modified in transit | Direct |
| AG07: Replay Attacks | Valid requests captured and repeated | Direct |
| AG08: Model Inversion | Extracting training data via queries | - |
| AG09: Prompt Injection | Malicious inputs hijack agent behavior | Roadmap |
| AG10: Audit Trail Gaps | Missing or insufficient logging | Direct |
Threat Model
CapiscIO Guard addresses specific threats in agent-to-agent communication
Threat: An attacker impersonates a trusted agent (e.g., "billing-agent") to trigger unauthorized actions.
Mitigation: When Guard is deployed, it verifies Ed25519 signatures on incoming A2A requests. RFC-006 extends this to MCP tool invocations with per-call authorization. RFC-007 enables mutual authentication so clients can verify MCP server identity.
Threat: An attacker captures a valid signed request and replays it multiple times.
Mitigation: Strict iat/exp timestamp validation with a 60-second default window and 5-second clock skew tolerance. Requests outside this window are rejected.
Threat: A man-in-the-middle modifies the request body (e.g., changes transfer amount) after signing.
Mitigation: The signature covers a SHA-256 hash of the body (bh claim). Any modification to the body invalidates the signature.
Threat: An agent delegates authority to a sub-agent, which then exceeds its granted scope.
Mitigation: RFC-008 delegation envelopes enforce monotonic narrowing — authority provably shrinks at every hop. The gateway PEP validates the full chain and rejects requests that exceed delegated scope.
Threat: Agents are deployed without registration, making them invisible to governance and audit.
Future: RFC-004 enables telemetry reconstruction to detect unregistered agents participating in flows.
Threat: Agents perform actions that violate organizational policies (e.g., accessing restricted data).
Addressed: The RFC-005 policy engine enforces access rules via an embedded OPA PDP with four enforcement modes (Observe → Guard → Delegate → Strict), obligation semantics, and break-glass override.
What Guard Verifies Today
RFC-001–003 are generally available. These checks run per request when Guard is deployed inline.
Identity
- • Ed25519 signature verification
- • Trust Badge validation (Levels 0–4)
- • Key ID (
kid) resolution - • Issuer (
iss) claim verification
Integrity
- • SHA-256 body hash binding
- •
bhclaim verification - • Compact JWS format validation
- • Protected header integrity
Freshness
- •
iatissued-at validation - •
expexpiry enforcement - • 60s default time window
- • 5s clock skew tolerance
What Guard Doesn't Do
Honest boundaries. No false promises. Guard does one thing well.
Not a prompt filter
Guard doesn't inspect or sanitize prompt content. It verifies the caller, not the message semantics. Use dedicated prompt security tools for content filtering.
Not rate limiting
Guard the library doesn't throttle requests. The CapiscIO Platform policy engine can attach rate-limit obligations to allow decisions via RFC-005, but for volume-based DDoS protection, pair with your existing API gateway.
Not authorization (Guard library)
Guard the library proves who is calling, not what they're allowed to do. For authorization, the CapiscIO Platform provides a full policy engine (RFC-005) with DID allowlists, trust level requirements, MCP tool scoping, and enforcement modes.
Not content moderation
Guard doesn't block toxic content or policy violations. Use appropriate content filters upstream. Guard focuses on identity, integrity, and freshness.
Not a replacement for IAM
CapiscIO handles agent-to-agent identity, not user authentication. Continue using Okta, AWS IAM, or your existing identity provider for user login.
Not LLM safety
We verify which agent sent a request and whether the payload was tampered with. We do not detect jailbreaks or prevent harmful model outputs.
Guard does one thing well: cryptographic identity verification with tamper detection and replay protection.
Telemetry & Privacy
How Guard handles logging and what it never logs
What Guard logs (when enabled)
- Decision outcomes (allow/deny)
- Agent ID (
issclaim) - Key ID (
kid) used for signing - Timestamps and decision duration
- Failure reasons (signature invalid, expired, body mismatch)
What Guard never logs
- Request body content or payloads
- Full JWS tokens
- Private keys or key material
- User PII or credentials
Example Telemetry Schema
If you log Guard outcomes, we recommend a structured JSON event like:
{
"ts": "2025-01-15T14:32:10.847Z",
"event": "guard.decision",
"decision": "allow", // or "deny"
"agent_id": "billing-agent",
"key_id": "billing-prod-2025",
"latency_ms": 2,
"endpoint": "/api/ledger/credit",
"method": "POST",
// Only present on deny:
"deny_reason": null, // or "signature_invalid", "expired", "body_mismatch"
"error_code": null // or "SG-001", "SG-002", etc.
}Exact fields depend on your integration. This format works well with Datadog, Splunk, and OpenTelemetry.
Trust Levels (RFC-002)
Progressive identity assurance for different deployment scenarios
| Level | Name | Verification | Use Case |
|---|---|---|---|
0 | Self-Signed (SS) | Agent generates and signs its own keys | Dev/test environments |
1 | Registered (REG) | Agent registered with CapiscIO CA (account verification) | Internal agents, staging |
2 | Domain Validated (DV) | Agent proves control of domain via DNS or HTTP challenge | Public agents, APIs |
3 | Organization Validated (OV) | Verified business entity information | B2B integrations |
4 | Extended Validation (EV) | Full organizational audit, security review, and legal agreement | Financial, healthcare |
Enforcement in Guard
Guard verifies the badge and returns the trust level in claims. Enforce requirements in your middleware:
# Verify badge and enforce minimum trust level
claims = guard.verify_inbound(badge_token, body=request.body)
# claims["trust_level"] contains the badge's trust level (0-4)
if claims["trust_level"] < 3:
raise HTTPException(403, "Organization Validated badge required")Need compliance framework mappings?
SOC 2 Type II, ISO 27001, and NIST 800-53 control-by-control mappings with evidence locations for your auditor.
How We Harden the Product
Verifiable security practices across CI, supply chain, API surface, and runtime operations.
- govulncheck — CI-blocking, zero known vulnerabilities
- gosec SAST — CI-blocking, zero unresolved findings
- Both cloud and enterprise editions tested in CI matrix
- Pinned tool versions to prevent supply chain drift
- SHA-256 checksums on every binary distribution channel
- Fail-closed mode (
CAPISCIO_REQUIRE_CHECKSUM) - SBOM generation at release time
- Covers CLI, Python SDK, Node wrapper, GitHub Action
- 34 API error response paths scrubbed — no internal details leak
- SSRF scheme allowlist (HTTP/HTTPS only, before DNS resolution)
- Architectural multi-tenant isolation on SDK routes
- HTTP server timeout hardening (ReadHeaderTimeout, IdleTimeout)
capiscio_auth_failures_totalcapiscio_badge_verification_failures_totalcapiscio_pep_cache_misses_totalcapiscio_breakglass_events_total
CAPISCIO_REJECT_SELF_SIGNED— hard-reject dev credentials in prod- File permission hardening (0600 on all sensitive outputs)
- Concurrent-safe session stores with race detection tests
- Dependency hygiene — Go stdlib + gRPC CVE patches current
- E2E security tests: SQL injection, XSS, cross-org isolation
- Race detection tests (100 concurrent goroutines)
- Auth boundary enforcement tests across both editions
- Checksum verification tests (match, mismatch, fail-closed)
Ready to evaluate CapiscIO for your environment?
Start with the open source Guard and CLI. Contact us for security architecture reviews and enterprise deployments.