Least authority
Use scoped capability grants instead of handing agents unrestricted credentials. Grant only the operations and resources required for the workload.
Security for AI that can act.
You cannot always predict why an agent will behave incorrectly. You can still define the authority it receives—and preserve evidence of what it does.
Identity-first execution
Tie requests and policy decisions to an agent and execution context. Investigations should begin with an attributable event, not an anonymous process.
Fail closed at the broker
Sensitive brokered operations require valid authorization. Revoking a grant removes that brokered authority; it does not revoke credentials that have escaped the runtime.
Detect and contain abnormal activity
Identify abnormal resource consumption, repeated failures, and unexpected execution activity. Contain affected managed workloads and retain evidence for investigation.
Explicit isolation boundaries
JoyMux is not a universal kernel sandbox. Child processes can make their own system calls. Pair runtime controls with appropriate OS, container, or VM controls for filesystem and network isolation.
EXAMPLE RUNTIME EVENTAuthority checked.
Authority checked.
Evidence retained.
This interactive example shows policy denial and managed-process containment. It is an illustrative scenario, not a customer incident. Unbrokered child-process activity needs additional isolation controls.
J/ EXECUTION CONTROLIllustrative scenario
build-agent-14healthy
JoyMux boundary
jm-8F32APOLICY ENGINEAgent identity bound
CPU 24% Memory 1.8 GB Network Observed Filesystem Brokered
✓ Read workspace· Privileged action
CPUMemoryProcessesInfrastructure
EVENT 01
Agent starts with an attributable execution session.
Identify
Example policy flow. Enforcement depends on surface and configuration.
A COMPLEMENTARY LAYER
Different layers. Different responsibilities.
Conceptual emphasis, not a feature verdict on individual vendors. Capabilities vary by product and integration.
| Responsibility | Model-focused AI security | Application observability | JoyMux runtime security |
|---|---|---|---|
| Model output monitoring | Primary focus | Application signals | Integration-dependent |
| Prompt / content controls | Primary focus | Application signals | Complementary layer |
| Agent identity | Varies | Correlation context | Execution context |
| Process-level visibility | Varies | Host instrumentation | Managed sessions |
| Resource limits | Varies | Usage visibility | Deployment-dependent |
| Runtime enforcement | Varies | Integration-dependent | Brokered actions |
| Privileged-action control | Varies | Integration-dependent | Scoped capability grants |
| Execution containment | Varies | Integration-dependent | Managed process cancellation |
| Crash recovery | Varies | Failure visibility | Workload-dependent recovery |
| Session persistence | Varies | Telemetry storage | Durable execution events |
| Infrastructure audit trail | Varies | Logs & traces | Runtime decision evidence |
CONTROL WHAT COMES NEXTAI agents are getting more authority.