KOR IT LAB / 02
Security Lab
The Security Lab is where the agent security architecture is exercised rather than diagrammed. It exists to test whether the controls we design — provenance on memory, policy at recall, mediation at the tool boundary — hold up when a working system runs against them.
- Agent security
- Memory security
- Runtime policy
- Tool security
- Threat detection
- SOC automation
Provenance at write time versus reconstruction at recall
Question
Can the origin and trust level of a memory record be recovered after the fact, or must it be attached when the record is created?
Method
Memory records in the lab are written through an ingestion path that assigns a provenance class — origin, authoring context, trust level. We then attempted to reconstruct that class for records where it had been omitted, using the surrounding session context and the record's own content.
Findings
- Attaching provenance at write time, rather than attempting to reconstruct it at recall time, is what makes the class usable. Once a memory record exists without its origin, the origin is effectively unrecoverable.
- Provenance classes are only as correct as the ingestion path that assigns them. Where the path is wrong, the class is wrong, and the runtime will confidently act on a mislabelled record.
- Recall-time policy is meaningless without write-time provenance: there is nothing to evaluate against.
Limitations
SOC observability of agent activity
Question
What would a SOC actually see if an agent in this environment were influenced by untrusted content, and would existing detection content join the events?
Method
The lab's monitoring stack was built specifically to observe agent behaviour: retrieval, tool invocation, policy decisions and approvals are emitted as events alongside conventional infrastructure telemetry.
- Alert rules
- 55
- Alert groups
- 18
- Dashboards
- 6
Lab measurement from a tested configuration in an experimental environment. Not a benchmark, and not portable to other hardware, models or workloads.
Findings
The figures above describe how much instrumentation exists in the lab's own monitoring configuration. They say nothing about how well anything performs, and they are not a customer deployment.
- Memory writes are rarely security-relevant events in conventional telemetry, so the originating action is often absent from the data a SOC holds.
- Recall is implicit unless it is deliberately emitted: without it, nobody can see which stored records shaped a given decision.
- Agent identity collapses provenance — every downstream action shares one principal, regardless of who influenced the reasoning.
- Existing detection content assumes bounded sessions, which agent memory deliberately outlives.
Limitations
Next experiments
Written down before they are run, so the results can be judged against what we set out to find rather than what we happened to notice.
Run controlled memory-poisoning attempts against the provenance model: write untrusted content, then measure whether and when it is recalled and acted upon in later sessions.
Test whether quarantined records can be reintroduced into recall through indirect paths such as summarisation or derived memory.
Quantify the cost of human approval gates — how many high-risk actions are actually stopped, and how much latency the gate adds per session.