--- title: "Security for the agent era" canonical_url: https://auteurintelligence.com/security/ description: "Security posture: private sandboxed workspaces, allowlisted tools, spending limits, and human gates on anything that spends, publishes or changes canon." --- # Security for the agent era **Agents changed what an attack looks like.** The threats that matter now are not the ones your antivirus knows: they are prompt injections hiding in a document you ingest, a poisoned skill pack that behaves until it does not, a secret leaking into a repository at 2am, an agent that takes one step further than you authorized. Auteur Intelligence™ was built with those threats in mind from the first line, because we run our own productions on this platform and we are the first target of our own mistakes. --- ## Not your antivirus. The layer above it. We do not replace your virus protection, and you should keep it. We work the layer it has not yet thought of, the one attackers think about all the time: the space between a model, the content you feed it, and the authority you give it. Traditional security watches your files and your network. Agent-era security has to watch your instructions. --- ## What we actually built - **Prompt-injection screening on the way in.** Inbound content, documents, and skills are screened for malicious instructions before they touch the project. A poisoned PDF should fail at the door, not at the timeline. - **A nightly integrity sweep.** Every night, the repository is scanned for leaked secrets and policy violations, using detectors whose findings are human-audited, not silently allowlisted. What the sweep finds, you hear about. - **A gate on every push.** Code cannot leave a machine without passing the repository security policy: secrets scanning and policy checks run on every push, to every branch, because a secret on a feature branch is just as leaked. - **Sandboxed seats.** Every agent works inside boundaries it did not choose: private, sandboxed workspaces, allowlisted tools, spending limits, and approval gates. A seat that tries to exceed its authority is refused, and the refusal is receipted. - **A sentinel on the hosts.** Host health is watched continuously, and mutations are refused when a host is not in a state to be trusted. - **Receipts for everything.** Every action writes to a ledger you can audit. Security you cannot inspect is a promise; security you can read is a property. --- ## Many models, one immune system A single model reviewing its own output is a single point of failure, and attackers know it. Auteur's combination of model architectures is the safer design: work produced by one model family is screened and reviewed by another, so a jailbreak or blind spot that fools one architecture meets a different one at the gate. This is not theory. On this site's own build, cross-family verification caught 16 seat failures before it reached the site, and zero shipped. One vanilla harness, alone, catches none of what it cannot see. “Before tonight’s build, screen the three community skill packs I downloaded for prompt injection and over-broad permissions, and quarantine anything that asks for more than it needs.” The ask that should be normal “Two packs are clean and staged. The third contains an instruction block addressed to the model inside a help file, asking it to export your provider keys. Quarantined, receipted, and reported. Nothing entered the project.” Illustrative exchange. Inbound screening, allowlists, and quarantine receipts are shipped surfaces. --- ## Measured, not promised No security layer catches everything, and we will not tell you otherwise. Coverage here is measured, receipted, and improved by the same eval and memory that improve everything else in the studio. When something is caught, it is on the record. When something changes, the record says so. That is the difference between a security feature and a security posture.