Developer documentation

CAIN Agent Security

Last reviewed 31 August 2026

CAIN Agent Security

Status: LIVE + FUNCTIONAL

Real-time threat detection and enforcement for AI agents.

What is CAIN Agent Security?

CAIN Agent Security protects AI agents from internal and external threats by evaluating every action against identity, trajectory, policy, and behavioral signals.

Core principle: Security must be in the execution path, not just a dashboard afterward.

Threat Types Evaluated

1. PROMPT_INJECTION - Malicious instructions attempting to override agent behavior

2. INDIRECT_PROMPT_INJECTION - Hidden instructions in retrieved content

3. TOOL_MISUSE - Authorized tools used for unauthorized purposes

4. CREDENTIAL_MISUSE - Credentials used outside permitted scope

5. PRIVILEGE_ESCALATION - Attempt to gain higher privileges

6. UNAUTHORIZED_TOOL_ACCESS - Access to tools not permitted for this agent

7. SENSITIVE_DATA_EXPOSURE - Attempt to access sensitive data inappropriately

8. SECRET_LEAKAGE - Attempt to exfiltrate credentials or secrets

9. MALICIOUS_TOOL_OUTPUT - Tool output containing malicious content

10. MEMORY_POISONING - Attempt to corrupt agent memory/context

11. SUSPICIOUS_BEHAVIOR - Behavioral patterns indicating compromise

12. EXCESSIVE_PERMISSIONS - Agent accumulating unnecessary permissions

13. UNEXPECTED_TOOL_CHAIN - Suspicious sequence of tool calls

14. DANGEROUS_DESTINATION - Action targeting internal/dangerous destinations

15. ABNORMAL_ACTION_FREQUENCY - Rate of actions indicates automated attack

16. AGENT_IDENTITY_MISMATCH - Identity assertion doesn't match records

17. DELEGATION_VIOLATION - Acting beyond delegated authority

18. POLICY_VIOLATION - Action violates security policy

19. TRAJECTORY_ANOMALY - Action creates unsafe trajectory pattern

20. MCP_SPECIFIC_THREAT - Threats specific to MCP protocol

21. EXECUTION_BOUNDARY_VIOLATION - Crossing enforcement boundaries

Security Verdict States

• ALLOW - Action permitted, proceed with execution
• DENY - Action blocked, do not execute
• REQUIRE_APPROVAL - Human approval required before execution
• UNKNOWN - Security state unclear, fail-closed
• ERROR - Security subsystem unavailable, fail-closed

Architecture

AGENT → IDENTITY → SECURITY EVALUATION → TRAJECTORY ANALYSIS
     → CONTROL CHECK → CAIN DECISION → ENFORCEMENT
     → TOOL/MCP EXECUTION → EVIDENCE

API Endpoints

• POST /fabric/security/evaluate - Evaluate action security
• GET /fabric/security/threats - List threat events
• GET /fabric/security/posture/{agent_id} - Get agent posture
• GET /fabric/security/posture - List all agent postures
• POST /fabric/security/posture - Create/update posture
• POST /fabric/security/contain/{agent_id} - Contain agent (emergency stop)
• GET /fabric/security/incidents - List security incidents
• GET /fabric/security/health - Health check

Evidence Model

Every security decision produces evidence containing:

• threat_type
• severity
• confidence
• evidence (pattern matched, context)
• agent_id
• identity_id
• tenant_id
• verdict
• enforcement action
• timestamp
• decision_id

Enforcement Guarantees

1. Fail-closed: Unknown security states result in DENY, not ALLOW

2. No silent failures: Security errors result in ERROR verdict

3. Tenant isolation: One tenant cannot read another's security data

4. Evidence durability: All decisions recorded with integrity checks

Dashboard

Live dashboard at /agent-security with:

• Real-time security evaluation
• Attack simulation
• Threat event display
• Agent posture overview