Can enterprise security controls actually verify every action that an autonomous software agent executes across internal infrastructure?
Existing runtime controls deployed to monitor large-language model agents leave uninspected paths because their defensive visibility depends strictly on physical placement within the software stack. While enterprise teams routinely install runtime controls to inspect actions in real time, a control can only evaluate the specific actions that cross the exact point where it is placed. According to researchers Kentaroh Toyoda and Alex Leung of Vulcan Research, AIFT, Singapore, alongside Bhuvaneswari U from Standard Chartered, India, an agent can act through routes outside the conventional tool-call channel, and no prior methodology has measured this defensive coverage against kernel-level ground truth.
Execution Paths and Placement Limits
Organizations running production agents commonly introduce specialized defensive software layers. Agent gateways such as agentgateway, Envoy AI Gateway, and Microsoft's Agent Governance Toolkit interpose a check on network traffic between an agent harness and its tool servers. Guardrail engines like NeMo Guardrails and LlamaFirewall screen model inputs and outputs against safety policies, while policy engines such as Progent and ActPlane decide whether a concrete action may execute. Meanwhile, monitoring tools including AgentSight and Tetragon observe agent behavior from outside the host process.
What happens when an agent initiates an operational command that bypasses the network gateway entirely?
Such actions take effect without inspection. A gateway positioned in front of an agent harness observes tool requests with complete semantic context, but an agent harness can also spawn local tool servers as child processes or establish direct network connections. Conversely, kernel-level monitoring using an extended Berkeley Packet Filter observes nearly every action in the process tree of the agent, yet eBPF records lack payload content and intermingle processes unrelated to the agent.
"guardscope works in two stages: a static stage that predicts which of an agent’s 15 action paths a control can check from its source, and an empirical stage that runs a fixed workload on a deployment that realizes one of eight topology designs and classifies every executed action as checked, bypassed, or prevented by reconciling the control’s decision records against kernel-level ground truth."
This gap between operational placement and runtime coverage reveals why perimeter inspection alone leaves systems vulnerable to unseen execution routes.
Verifying Coverage Across System Topologies
To make this coverage measurable, the researchers developed guardscope, an evaluation framework operating in two distinct phases. In the first phase, static analysis inspects the source code of a control to predict which of an agent's 15 action paths the software can evaluate. In the second phase, an empirical workload runs 15 action instances against a system deployment realizing one of eight topology designs, verifying what the control reports against host kernel records.
"guardscope makes a control’s coverage claim verifiable: a runtime control developer can publish which paths its product inspects under a kernel-verified protocol."
By reconciling defensive log entries with operating-system truth, guardscope classifies each executed action as checked, bypassed, or prevented. Across empirical evaluations using the agent harnesses Pi and OpenClaw, the authors tested real runtime controls, deploying Microsoft's agent governance toolkit as the gateway control, ActPlane as the kernel-level control, and a Tracee eBPF sensor to establish kernel-level ground truth. The runs confirmed predicted coverage limits for the tested action classes.
Enterprise security strategies that rely exclusively on gateway checkpoints leave blind spots across execution routes operating beneath the network layer. As autonomous agents take on direct system access, organizations must evaluate monitoring architectures against operating-system activity rather than assuming single-point runtime controls catch every command. Future deployment standards will require runtime control vendors to certify verifiable path coverage against host-level telemetry.
What doesn’t add up
Enterprises roll out protective gateways like Microsoft's Agent Governance Toolkit to enforce strict control over autonomous agents, yet these security checks remain completely blind to direct network calls and local child processes. This architectural split undermines the entire oversight layer: an edge gateway understands semantic intent but misses hidden execution paths, while kernel-level eBPF sensors capture raw OS events across process trees but lose payload context. The guardscope benchmark proved this across 15 action scenarios, confirming that perimeter guards routinely fail to verify operations when an agent steps outside standard tool calls. Network compliance dashboards proudly display green checkmarks for every inspected request, while the agent quietly executes untracked commands directly underneath them.