| name | unfireable-safety-kernel-agent-alignment |
| category | ai-safety |
| description | Execution-time AI alignment architecture using an unfireable safety kernel that operates outside the agent's address space. Ensures safety controls cannot be bypassed by the AI agent itself, addressing the fundamental vulnerability of in-process guardrails. |
| trigger_words | agent safety, AI alignment, safety kernel, execution-time control, guardrail, agent sandbox, tool access control, agent governance |
| arxiv | 2606.26057 |
| authors | Anthropic |
| published | 2026-06-24 |
Unfireable Safety Kernel for AI Agent Alignment
Overview
AI agents with access to tools, APIs, and infrastructure become active principals in those systems. The dominant safety approach places controls inside the agent's own runtime (system prompts, output filters, guardrail libraries), but any control in the agent's address space is reachable and potentially bypassable by the agent itself. This methodology proposes an unfireable safety kernel that operates outside the agent's address space.
Core Architecture
- Out-of-Process Safety Kernel: Safety enforcement runs in a separate, isolated process that the agent cannot modify or terminate
- Mandatory Interception: All agent actions (tool calls, API requests, file operations) must pass through the kernel before execution
- Capability Enforcement: The kernel maintains and enforces capability policies independent of the agent's internal state
- Non-Bypassable Design: The kernel cannot be "fired" (terminated, modified, or circumvented) by the agent
Key Steps
- Separate Runtime: Deploy agent and safety kernel in separate processes/containers with strict isolation
- Mandatory Access Control: Kernel intercepts all agent-initiated actions before they reach external systems
- Policy Evaluation: Each action is evaluated against pre-defined safety policies
- Action Mediation: Approved actions are forwarded; denied actions are blocked with audit logging
- Immutable Configuration: Safety policies are stored in a location the agent cannot modify
- Audit Trail: All decisions (allow/deny) are logged to tamper-evident storage
When to Use
- AI agents with tool/API access in production environments
- Multi-agent systems requiring inter-agent safety guarantees
- Any scenario where agent self-modification could bypass safety controls
- Systems requiring regulatory compliance for AI behavior
Implementation Notes
- Use OS-level isolation (namespaces, seccomp, capabilities) to separate kernel from agent
- Implement allowlist-based action policies rather than denylist (more robust)
- Design kernel to be minimal — smaller trusted computing base reduces attack surface
- Consider hardware-level isolation (enclaves, secure boot) for highest assurance
- Kernel should maintain its own state independently of the agent
Pitfalls
- Overly restrictive policies can render the agent useless — balance safety and utility
- Kernel becomes a potential single point of failure — design for availability
- Latency overhead from mandatory interception — optimize for common-case fast paths
- Policy update mechanisms must be secure — use signed updates from trusted source
- Agent may attempt social engineering of kernel operators — implement policy changes through formal processes only
