Design agent systems you can trust with real tools and permissions — least privilege, isolation, and auditability.
Agents that take actions need real security, not prompt-level hope. We design agent runtimes with clear tool and permission boundaries, a separation between trusted control and untrusted input, sandboxing, and audit trails — the approach behind Stewra's hardened two-plane agent security.
Scope every tool to least privilege with explicit, auditable boundaries.
Keep the trusted control plane isolated from untrusted model output and external content.
Contain what an agent can do and reach, with runtime guardrails and audit logging.
Inventory every tool and permission the agent will hold, and what each one can reach if it is used wrongly.
Isolate the trusted control plane from untrusted model output and external content, so a hostile input cannot become an instruction.
Scope every tool to least privilege, sandbox what the agent can touch, and log actions so a decision can be reconstructed after the fact.
Exercise the boundaries deliberately — the design is only worth something if someone has tried to get past it.
AI assistants that take real actions need real security, and most treat the prompt as the only guardrail. Stewra runs on a two-plane architecture that separates the trusted control plane from untrusted input, with least-privilege tool design and LiveKit real-time voice.
No. A prompt is a request, not a boundary — anything that can put text in front of the model can compete with it. Agents that take real actions need the boundary enforced where the tool call happens: least-privilege scoping on every tool, a trusted control plane held separate from untrusted model output and external content, sandboxing, and an audit trail. The prompt is the last layer, not the only one.
Keeping the trusted control plane — the code that decides what is allowed — isolated from untrusted input, which includes model output and anything the agent reads from the outside world. It means a hostile document or a manipulated response can influence what the agent says, but cannot become an instruction the system obeys. It is the approach behind Stewra's hardened agent security.
Both. On an existing system the work usually starts by inventorying every tool and permission the agent already holds and what each one can reach if used wrongly — which is frequently the first time that list has existed in one place.
An agent architecture design, a threat model and permission map, and a guardrail and audit plan — with the boundaries exercised deliberately rather than assumed, because a design nobody has tried to get past is untested.