Containing agents at the syscall, not in the prompt

Most agent safety stacks still start in the prompt. That is the wrong layer. A model can be told not to touch production files and still do it the moment a tool call is available.

I treat the kernel as the boundary. If an agent process tries a syscall that is outside policy, the answer is EPERM. The model can keep talking. The OS does not.

What belongs in the TCB

AgentGuard is a Linux eBPF LSM supervisor. Policy lives in YAML in the repo. Deny is enforced at the syscall. Hooks and CLAUDE.md can explain a deny after the fact, but they are not the trusted computing base.

That split matters. Feedback can be wrong, ignored, or rewritten. A kernel deny cannot.

What I keep iterating on

The interesting work is not the deny itself. It is making policy tight enough that a coding agent can still be useful: write in the right tree, talk to the right sockets, and fail loudly when it wanders.