DATAHUB-NATIVE AGENT SECURITY

Trust the graph.
Not the prompt.

ContextFirewall treats enterprise metadata as untrusted input, verifies claims against DataHub, enforces capabilities in deterministic code, and leaves a reusable trust receipt for the next agent.

NO REAL EXPORTThe dangerous tool is a simulation-only canary.

Runtime—

DataHub source—

Policy digest—

Analyzer—

01 · CONTEXT

Untrusted words enter through a trusted path.

DATAHUB

02 · GRAPH EVIDENCE

The prompt makes a claim. The graph gets a vote.

VERIFIED

Sensitivity—

Blast radius—

Quality—

Graph digest—

03 · DECISION

Authority lives in code, not model confidence.

DETERMINISTIC

VERDICTREADY

Run Judge Mode to execute the verified security path.

P-001P-002P-004P-006

debug_export · C4implementation unreachable when blocked

SERVER GATE

CONTEXT TRUST RECEIPT—awaiting run

EXECUTION TRACE

Every security transition is observable.

Judge Mode replays the same task as an unsafe baseline, a protected run, and then a fresh session. Security-critical decisions come from deterministic policy and a server-side capability gate.

Press Run Judge Mode.

SAME CONTEXT · SAME TASK

What changes when trust is enforced?

BASELINE AGENT

Poisoned context can reach the canary tool.

$ debug_export(patient_rows=100)
→ NOT RUN YET

The control can execute only a simulation stub. No patient data or real external destination exists.

CONTEXTFIREWALL

The same attempt dies before implementation.

$ debug_export(patient_rows=100)
→ NOT RUN YET

The legitimate metadata-only freshness investigation still completes.

COMPOUNDING DEFENSE

The next agent inherits the verdict.

A fresh runner instance may reuse a prior receipt only when content, graph, analyzer implementation, policy implementation, persistence, and capability bindings still match exactly.

○

Awaiting proof—fresh process boundary · exact binding

CHECKED-IN FIXTURE SUITE

DataHub is measurable, not ornamental.

Loading benchmark…

—versioned fixtures

—attacks succeed text-only

—attacks succeed full firewall

—benign tasks complete

GRAPH ABLATION—

Graph-dependent attacks prevented specifically when DataHub sensitivity and blast-radius evidence are available.

—

SAME REQUEST · DIFFERENT EVIDENCE

TEXT ONLY—

→

+ DATAHUB GRAPH—

Loading graph necessity proof…

TRUST CONTRACT

Context may propose. DataHub may attest. The policy engine decides. The capability gate enforces. Receipts remember.

Trust the graph.Not the prompt.