CORDON

Limit what an exposed agent can do

An agent can encounter hostile instructions while reading a document or receiving a handoff. CORDON explores how an agent runtime can restrict sensitive actions after that exposure, while retaining useful work by other agents.

Assume the injection lands

The runtime records provenance taint when an agent reads an untrusted channel. Credential requests pass through a broker that checks this state before calling its secret resolver. The recorded fixture reported 0. That observation is scoped to those controlled tests; the threat model still depends on instrumented tool calls and handoffs.

Tracing the outbreak

The reference monitor follows the recorded delegation graph to identify exposed agents and request their quarantine. Decisions are written to an Ed25519-signed, hash-chained audit log for replay. Agent taint and broker controls are separate from hardware isolation; the sandbox setup does not establish that boundary.

What the evaluation shows

0% against 60% for the keyword baseline, while preserving 85.7% vs 42.9% of benign work. The number worth stating plainly is the other one: 14.3%.

The evaluation is 17 cases: ten handcrafted attacks and seven benign controls. One benign request was denied. These results describe this fixture and baseline, not universal prompt-injection protection. The default demo is scripted; live integrations require provider credentials. No current remote-service availability or new evaluation was established by this update.