Self-Hosted AI Agent Defense: Collector and Executor Boundaries

What 1-SEC checks

The containment module dispatches explicit agent/tool/goal/memory events to its monitors. Event types and fields form an integration contract: a host running 1-SEC still needs an emitter that observes the actual framework actions and reports trusted context.

Read the implementation: HandleEvent

Required telemetry and context

Relevant input events: agent_action, tool_call, agent_goal, agent_memory_write. Use a trusted producer at the real application boundary.

• agent_id
• action
• tool
• target
• source
• framework-specific collector context

Field names above describe relevant context, not a complete API request. Consult the current event contract for envelope and detail requirements. Preserve booleans, numbers, and strings as the receiving handler expects them. Agent-provided text cannot independently verify identity or authorization.

Deployment, prevention, and response

Identify the service account, executable, writable paths, tool endpoints, and event producer. Start with a synthetic action event and confirm the expected alert arrives with the correct agent and target. Validate response history in dry-run before enabling destructive actions on a dedicated host.

Record the source event, affected agent/host, actual target, policy decision, and response result. Review enforcement configuration separately from detection. A recommendation, selected action, dry-run record, and completed action are different outcomes.

Reproduce the source fixtures

From a checkout of the linked 1-SEC source revision, run the selected fixtures with the repository's Go toolchain. These commands run tests; they do not execute a real attack against your systems.

go test ./internal/modules/aicontainment -run '^(TestContainment_Start_Stop|TestContainment_HandleEvent_AgentAction)$' -count=1

The referenced source fixtures ran in the selected local package suites. Helper tests and synthetic events establish only the assertions shown, not production prevention or framework compatibility.

func TestContainment_Start_Stop(t *testing.T) {
	c := New()
	cfg := core.DefaultConfig()
	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()

	if err := c.Start(ctx, nil, nil, cfg); err != nil {
		t.Fatalf("Start() error: %v", err)
	}
	if c.policyEng == nil {
		t.Error("policyEng should be initialized after Start")
	}
	if c.shadowDet == nil {
		t.Error("shadowDet should be initialized after Start")
	}
	if c.agentTracker == nil {
		t.Error("agentTracker should be initialized after Start")
	}
	if c.toolIntegrity == nil {
		t.Error("toolIntegrity should be initialized after Start")
	}
	if c.goalMonitor == nil {
		t.Error("goalMonitor should be initialized after Start")
	}
	if c.memoryMonitor == nil {
		t.Error("memoryMonitor should be initialized after Start")
	}
	if c.cascadeMonitor == nil {
		t.Error("cascadeMonitor should be initialized after Start")
	}
	if err := c.Stop(); err != nil {
		t.Fatalf("Stop() error: %v", err)
	}
}

// ─── PolicyEngine ─────────────────────────────────────────────────────────────

func TestContainment_HandleEvent_AgentAction(t *testing.T) {
	cp := makeCapturingPipeline()
	c := startedModuleWithPipeline(t, cp)
	defer c.Stop()

	ev := core.NewSecurityEvent("test", "agent_action", core.SeverityInfo, "agent action")
	ev.Details["agent_id"] = "agent-1"
	ev.Details["action"] = "read file"
	ev.Details["tool"] = "shell_exec"
	ev.Details["target"] = "/tmp/data"
	ev.SourceIP = "10.0.0.1"

	if err := c.HandleEvent(ev); err != nil {
		t.Fatalf("HandleEvent() error: %v", err)
	}

	if cp.count() == 0 {
		t.Error("expected alert for blocked tool shell_exec")
	}
}

Tuning, evaluation, and coverage limits

No universal transparent adapter is established for every self-hosted framework. Event telemetry cannot observe actions that bypass the instrumented executor. Host permissions, sandboxing, network controls, and recovery remain separate deployment requirements.

Evaluate this behavior with representative authorized activity and a controlled known-positive case. Investigate the exact rule, inputs, and state before suppressing an alert. Do not assume a hard-coded heuristic is a configurable setting. Measure your own deployment; the source fixtures do not establish a benchmark, detection rate, compliance certification, or incident-prevention claim.