The vocabulary of AI containment.
Most confusion in this field is vocabulary confusion. "Sandboxed", "isolated" and "secure" get used for four different things, and the difference between them is usually the difference between a boundary and a preference. These are the terms BitShout uses, defined precisely enough to disagree with.
Authority and permission
The ideas that decide what a process is allowed to do, and why the default matters more than the list.
Ambient authority
Ambient authority is the authority a process holds automatically because of who launched it, rather than because it was granted that authority for a purpose.
Capability brokering
Capability brokering is the practice of having a trusted intermediary perform an authorized operation using a credential it retains, returning only the result to the requester.
Capability-based security
Capability-based security is a model in which the right to perform an operation is carried by an unforgeable reference to a specific resource, rather than looked up from the identity of whoever is asking.
Confused deputy problem
A confused deputy is a program that holds legitimate authority and is manipulated by a less-privileged party into exercising that authority on their behalf.
Deny-by-default
Deny-by-default is a policy posture in which any request that does not match an explicit allow rule is refused, including requests the system does not recognise.
Least privilege
The principle of least privilege holds that a process should be given exactly the authority its current task requires, for no longer than the task takes, and nothing else.
AI agents and their failure modes
What changes about security when the software writes its own next step.
Agentic AI
Agentic AI describes systems that pursue a goal by choosing and executing their own sequence of actions through tools, rather than producing a single response for a person to act on.
Containment session
A containment session is the unit that binds a protected application, every process descended from it, and the policy and grants that apply to them, for as long as that application is running.
Model Context Protocol
The Model Context Protocol is an open standard through which AI applications discover and invoke external tools, giving a model the ability to act on systems beyond its own conversation.
Process lineage
Process lineage is the chain of parent-child relationships from a process back to its origin, treated as part of a security boundary so that a child cannot hold more authority than the process that spawned it.
Prompt injection
Prompt injection is an attack in which text that a language model processes as data is interpreted by the model as instructions, causing it to act on an attacker's behalf.
macOS security mechanisms
The Apple boundaries BitShout builds on, and what each one can and cannot enforce.
Endpoint Security framework
Endpoint Security is Apple's macOS framework that lets an entitled system extension observe and authorize security-relevant events, including file access and process execution, before the operating system permits them.
Network Extension
Network Extension is Apple's framework for extending macOS networking from user space, including content filter providers that can allow or deny individual network flows.
TCC
TCC is the macOS subsystem behind privacy consent prompts, gating application access to categories of protected data such as Documents, Desktop, the camera and Full Disk Access.
Evidence and failure behaviour
How a security tool should behave when it stops being able to prove things.
Fail-closed
A fail-closed system denies authority when it cannot determine or enforce the correct answer, rather than permitting the operation and continuing.
Tamper-evident audit log
A tamper-evident audit log is an append-only record whose entries are cryptographically chained, so that any alteration to a past entry is detectable even though it cannot be prevented.