docs: add "Why kernel enforcement, not a container per agent" positioning - #62
Merged
Merged
Conversation
…ning Answer Microsoft's Agent Governance Toolkit head-on. AGT ships identity, Merkle ledger, and a fail-closed policy engine, so those are not the differentiator. The defensible bundle is kernel per-action enforcement welded to per-agent identity + hash-chained ledger, single Linux host, non-K8s, with the agent removed from the verdict path. Defends four points on merits (container isolates a process tree not an action; leaves no per-action attributable trace; breaks on subprocesses / generated code / shared hosts; shared process boundary puts a compromised agent between policy and verification) and states the performance constraint (verdict must be a precomputed in-kernel map lookup, never an on-path solve). No new capability claims; anchors to the existing guarantees table and THREAT_MODEL §8. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds a README positioning section that contrasts Jinn Guard’s per-action, in-kernel enforcement model with a “one container per agent” approach (including an explicit comparison to Microsoft’s Agent Governance Toolkit), and explains why kernel placement matters for attribution, coverage of subprocesses, and fail-closed enforcement.
Changes:
- Adds a new README section arguing for kernel per-action enforcement vs. container-per-agent isolation.
- Describes attribution/audit implications (hash-chained, per-action ledger) and subprocess/host co-tenancy coverage.
- Adds a performance framing for keeping enforcement on a constant-time in-kernel map lookup.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+322
to
+324
| Rust SDK. It is MIT-licensed, Microsoft-signed, and widely adopted. So identity, | ||
| ledger, and policy are **not** what sets Jinn Guard apart. AGT has all three, and | ||
| in some respects has them further along. |
Comment on lines
+399
to
+405
| Per-operation BPF-LSM enforcement adds low-single-digit microseconds when the | ||
| verdict is an in-kernel map lookup. For agent workloads that overhead is | ||
| effectively free, and not by rounding. Every tool call an agent makes is gated | ||
| behind an LLM inference that costs on the order of hundreds of milliseconds to | ||
| seconds. That is five to six orders of magnitude more than the entire syscall | ||
| sequence the enforcement decision sits on. The governance layer is not on the | ||
| critical path in any measurable sense. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a README positioning section answering Microsoft's Agent Governance Toolkit (AGT) head-on.
Framing (claim-calibrated): AGT already ships per-agent identity, a Merkle tamper-evident ledger, a fail-closed policy engine, and a Rust SDK, so identity/ledger/policy are not the differentiator. The only superiority claim made is the specific bundle: kernel per-action enforcement welded to per-agent identity + a hash-chained ledger, single Linux host, non-K8s, with the agent removed from the verdict path.
Defends four points on merits:
Performance paragraph states the hard constraint: the in-kernel verdict must be a precomputed map lookup, never a userspace roundtrip or on-path solve.
No new capability claims. Anchors to the existing guarantees table and THREAT_MODEL §8. No "formal proof"/"no equivalent exists" language.
🤖 Generated with Claude Code