Agents

Process lineage

Also called: process tree · process ancestry · descendant tracking

DefinitionProcess lineage is the chain of parent-child relationships from a process back to its origin, treated as part of a security boundary so that a child cannot hold more authority than the process that spawned it.

If containment applied to one process, every agent would escape it in one line:

bash -c 'cat ~/.ssh/id_ed25519'

The agent is restricted. bash is not. The file is read. Nothing was bypassed, because nothing was in the way.

Process lineage is what closes that. The containment session is attached to the process tree rather than to a single PID, so a descendant four hops down is governed by the policy its ancestor was given — whether it is a shell, an interpreter, a package manager, a build script, or a binary the agent just compiled.

The test worth running

Whatever you use to restrict an agent today, run this: apply the restriction, then ask the agent to accomplish the same forbidden thing via a shell. Then via Python. Then via a postinstall hook in a package it installs.

Very often the answer is that authority resets at the first hop. That is not a misconfiguration to fix — it usually means the mechanism was designed to sandbox one process, and it is being used for a job it was not built for. See AI agent sandboxes on macOS for which mechanisms have this problem.

Exec replacement is the subtle case

Naive lineage tracking breaks on exec. When a process replaces its own image, the kernel sees the same process — same PID, same parent — running an entirely different program. If your model is “identify the executable once at spawn time”, you are now tracking a process whose identity you established for a binary that is no longer there.

BitShout models execReplace as its own execution operation for exactly this reason, and re-establishes target identity rather than assuming continuity. The same care applies to application updates: a replaced binary produces a fingerprint mismatch rather than inheriting its predecessor’s authority.

What lineage is not

Lineage is evidence, not identity. Knowing that a process descends from claude does not tell you what the process is — for that you need the resolved executable, its signing identity and its hash.

Nor is a process name authoritative anywhere in the chain. bash is a string that anything can be called. Lineage tells you which session a process belongs to; identity resolution tells you what is running. Both are needed, and neither substitutes for the other.