CAIN-42 CAIN Studio
Sign inGet started
Menu

Developer documentation

CAIN Agent Security

Last reviewed 31 August 2026

All docs

Status: LIVE + FUNCTIONAL#

Real-time threat detection and enforcement for AI agents.

What is CAIN Agent Security?#

CAIN Agent Security protects AI agents from internal and external threats by evaluating every action against identity, trajectory, policy, and behavioral signals.

Core principle: Security must be in the execution path, not just a dashboard afterward.

Threat Types Evaluated#

1. PROMPT_INJECTION - Malicious instructions attempting to override agent behavior 2. INDIRECT_PROMPT_INJECTION - Hidden instructions in retrieved content 3. TOOL_MISUSE - Authorized tools used for unauthorized purposes 4. CREDENTIAL_MISUSE - Credentials used outside permitted scope 5. PRIVILEGE_ESCALATION - Attempt to gain higher privileges 6. UNAUTHORIZED_TOOL_ACCESS - Access to tools not permitted for this agent 7. SENSITIVE_DATA_EXPOSURE - Attempt to access sensitive data inappropriately 8. SECRET_LEAKAGE - Attempt to exfiltrate credentials or secrets 9. MALICIOUS_TOOL_OUTPUT - Tool output containing malicious content 10. MEMORY_POISONING - Attempt to corrupt agent memory/context 11. SUSPICIOUS_BEHAVIOR - Behavioral patterns indicating compromise 12. EXCESSIVE_PERMISSIONS - Agent accumulating unnecessary permissions 13. UNEXPECTED_TOOL_CHAIN - Suspicious sequence of tool calls 14. DANGEROUS_DESTINATION - Action targeting internal/dangerous destinations 15. ABNORMAL_ACTION_FREQUENCY - Rate of actions indicates automated attack 16. AGENT_IDENTITY_MISMATCH - Identity assertion doesn't match records 17. DELEGATION_VIOLATION - Acting beyond delegated authority 18. POLICY_VIOLATION - Action violates security policy 19. TRAJECTORY_ANOMALY - Action creates unsafe trajectory pattern 20. MCP_SPECIFIC_THREAT - Threats specific to MCP protocol 21. EXECUTION_BOUNDARY_VIOLATION - Crossing enforcement boundaries

Security Verdict States#

  • ALLOW - Action permitted, proceed with execution
  • DENY - Action blocked, do not execute
  • REQUIRE_APPROVAL - Human approval required before execution
  • UNKNOWN - Security state unclear, fail-closed
  • ERROR - Security subsystem unavailable, fail-closed

Architecture#

AGENT → IDENTITY → SECURITY EVALUATION → TRAJECTORY ANALYSIS
     → CONTROL CHECK → CAIN DECISION → ENFORCEMENT
     → TOOL/MCP EXECUTION → EVIDENCE

API Endpoints#

  • POST /fabric/security/evaluate - Evaluate action security
  • GET /fabric/security/threats - List threat events
  • GET /fabric/security/posture/{agent_id} - Get agent posture
  • GET /fabric/security/posture - List all agent postures
  • POST /fabric/security/posture - Create/update posture
  • POST /fabric/security/contain/{agent_id} - Contain agent (emergency stop)
  • GET /fabric/security/incidents - List security incidents
  • GET /fabric/security/health - Health check

Evidence Model#

Every security decision produces evidence containing:

  • threat_type
  • severity
  • confidence
  • evidence (pattern matched, context)
  • agent_id
  • identity_id
  • tenant_id
  • verdict
  • enforcement action
  • timestamp
  • decision_id

Enforcement Guarantees#

1. Fail-closed: Unknown security states result in DENY, not ALLOW 2. No silent failures: Security errors result in ERROR verdict 3. Tenant isolation: One tenant cannot read another's security data 4. Evidence durability: All decisions recorded with integrity checks

Dashboard#

Live dashboard at /agent-security with:

  • Real-time security evaluation
  • Attack simulation
  • Threat event display
  • Agent posture overview