Watching the Boundary: Policy-Derived Detection and Containment for Autonomous Agent Evaluations

The policy-derived authorization envelope is a compelling organizing idea: it turns expected agent behavior into enforceable boundaries, detection signals, and graduated containment actions. The project is strengthened by a substantive repository, reproducible run artifacts, multiple experimental conditions, prompt-injection testing, and a fast independent policy implementation.

The evaluation would be considerably stronger with broader experimental coverage and clearer methodological detail. Please document the agent model, prompts, sampling settings, number of independent seeds, and how each reported result maps to a specific repository artifact. The prompt-injection result is encouraging, but nine trials across three variants are insufficient to establish robustness; additional injection families, indirect attacks, models, and repeated seeds would help. Likewise, the multi-agent experiment should cover more topologies, seeds, communication channels, and genuine value-transfer attempts.

The latency result should be described more narrowly. The reported nanosecond measurement benchmarks the in-memory policy classification function, not the complete request path including parsing, networking, logging, alerting, and decoy routing. An end-to-end load test would better support production-readiness claims. Finally, clarify how the stated tamper-evident audit property is implemented, such as through hash chaining, signatures, or an external append-only store. These additions would turn a strong prototype into a much more convincing security evaluation.

The report is not very specific, It doesn't specify at all what the "series of controlled experiments" the framework was evaluated on entail, nor which LLM(s) was/were used in the experiments. It lacks any related work citation. Hard to judge the framework.