CAIN-42 CAIN StudioCCAS · Module 1 of 5 · 14 min
The execution channel: why reading prompts is not enough
An AI agent talks and acts. The conversation channel carries prompts and replies; the execution channel carries tool calls, shell commands, database writes, payments and messages. Prompt filters and LLM guardrails inspect the first. The incidents that cost money happen in the second.
Agentic security therefore starts at the action boundary: the single place every consequential action must pass before it executes. If an action can reach a tool without crossing that boundary, nothing else in the design matters.
CAIN puts its decision pipeline exactly there. The agent proposes an action with its identity, intent and arguments; CAIN evaluates it; only an authorized action is released, with a signed record either way.
Key points
- Words and actions are separate channels; govern the actions.
- One boundary every consequential action must cross.
- No authorization → no execution.
- A refused action does not run, even if the surrounding text looked harmless.
In the CAIN-42 codebase
platform-gateway/cain_trust_kernel.py— the 16-stage causal execution context every decision runs throughcain/mcp_proxy.py— the MCPGate boundary that sits in front of MCP tools
Practice check
Practice 1 · choose one
Which channel carries tool calls and payments?
Practice 2 · true or false