Giselle Evita Koch

Enforceable AI Security

I build enforceable AI security systems

An AI agent turns text into side effects. Prompt filtering changes how often a model is fooled; it does not change what happens when it is. My work sits at the last control before execution — the tool call itself.

Agent Security Gate — a fail-closed policy decision point in front of agent tool calls

Security reviewer guide Try v0.7.1 locally (free) Benchmark evidence

The artifact

One system, tested with authored policy regressions and an external task suite.

Enforce

Agent Security Gate blocking an unsafe tool call and recording the decision

agent-security-gate v0.7.1

Authorization runs immediately before the callable and answers exactly one of allow, deny, or require approval. Only an explicit allow reaches the function: a denial, a malformed response, a timeout, or an unreachable policy engine all mean not executed. OPA/Rego policy, operation-bound human approvals, and a hash-chained audit trail behind it.

Release source Case study Benchmark protocol Threat model Internal pre-review

What was measured

Candidate-authored AgentDojo evaluation, a pinned local model, and a protocol frozen in git before the published run.

  1. Goals standalone attacker-goal success fell from 6/9 without ASG to 0/9 with ASG
  2. Policy 0 policy-violating tool calls executed, against 11 without the gate
  3. Cost 3 of 72 benign cases lost, all on a task that needs an approval-gated tool
  4. Latency 8 ms median, 13.5 ms p95 across 1,380 replayed authorizations
  5. Failure policy engine stopped: 70 of 70 calls denied, nothing executed

Scored-case security was 100% with and without the gate — this local model rarely followed the injection. The arms only separate in the standalone attacker-goal runs, and the published results say so rather than averaging it away.

Review status

Stated as it is.

Upstream proposal

A generic pre-execution authorizer seam proposed to AgentDojo. Open, awaiting a maintainer response.

AgentDojo issue #184

Independent reproduction

None yet. Everything published is candidate-authored; external reviewers are explicitly invited to falsify it.

Independent reproduction request

Authorship

Giselle designed, implemented, tested, and owns the final work; the authorship note explains an early Git identity mismatch.

AUTHORS.md

Writing

Technical notes on agent security and how to evaluate it honestly.

Why Agent Security Belongs at the Tool-Call Boundary

Pre-execution policy enforcement for tool-using LLM agents — where controls actually matter.

Read on GitHub

The Denial-Feedback Dilemma

Evaluating what an agent does after it is blocked, without overstating the evidence.

Read on GitHub

Supporting work

Two bounded artifacts on either side of the enforcement boundary.

vendor-red-team-passport

LLM vendor red-teaming — 10 attack classes, OWASP/NIST mapping, tamper-evident reports.

View on GitHub

secure-docs-aws

Serverless AWS document storage — Cognito, KMS, presigned URLs, ownership checks, audit logging.

View on GitHub

Target roles

Review it in 15 minutes

Start with the reviewer guide, run the five-minute protected-function and OPA-outage demo, and report any bypass or unsupported claim.

Get in touch