Solutions
Evidence, and the limits stated with it.
Most agent-security claims are assertions about configuration. These are readings: what the code signature asks for, what the system actually allowed, what the hook saw, and where those three disagree.
Declared is not granted
An entitlement is a request. TCC is the answer. Both are read, both are shown, and a cell that has only the first says “declared, not confirmed” rather than wearing a colour.
Controls that fire in testing
Four rules re-run rows from the guard's own behaviour matrix on every scan, forced to answer as if active. A control you never fired is an assumption.
Ingested content is data
Responses from connected accounts are wrapped and marked untrusted before they reach an agent. Mail and document text is the main route for prompt injection.
The three readings, and why all three
Config is what a tool chose to write about itself. Entitlements are vendor-independent and need no permission to read. TCC is what macOS allowed. Entitlements and TCC disagree in both directions, which is the reason to read both — and the roster also reports what is loaded, so a server running with no local declaration is listed and flagged rather than absent. How a cell gets its evidence.
An audit line that survives the pause
Every call is logged with the enforcement mode on the line, so a window where enforcement was off is visible afterwards with the calls that went through it — rather than being a gap that looks like quiet. Each line carries the tool, the session, the working directory and the process tree above the hook, so a block can be attributed to a caller. What the record supports.
Reducing what leaves the machine
The only control here that touches egress is narrowing what an agent can read in the first place. The projection is generated from the schema in front of it, drops full-text indexes first, clears URLs in every scope, and refuses to build when it meets a text column it has no rule for — so an upgrade to the recorder cannot widen it silently. Audio is dropped at every setting. The tiers and the scopes.