Harness: Permission Outside the Agent

Run a Sentinel-class host-side authority separate from the agent cell. It alone grants connector methods and all network egress. Muse: the agent proposes; only Sentinel can grant. Replicate that split even if you are not on Muse — the OpenAI Agents SDK is an in-app harness you host; it is not OpenAI’s managed Agents API.

Connector calls submit connector, method, action class, scope, and user-task context to the host. The host evaluates policy and allows, denies, or asks the human. Egress is inspected at L4 and L7 (hostname, resolved IP, port, protocol, method, path, decoded request), including SSRF protections so a public name cannot resolve to private infrastructure.

Real secrets stay in a vault/auth daemon. Runtime code sees surrogate tokens. After the host authorizes a concrete request, it replaces surrogates with the real credential at the network boundary. Workers get explicit credential allowlists (a calendar worker cannot fetch an email token by rewriting a parameter). Prompt-injection cannot reveal a secret the agent never saw.

When the host asks the user, the prompt is a client dialog describing the exact action — not a free-form chat reply the model can reinterpret. Grants can be one-use, session, task, time-window, or standing, and later requests must stay inside that scope. Tainted egress (process read untrusted/user data) drops auto-allow and falls back to approval.

Before widening auto-allow, run behavioral evals (prompt-injection / tool-abuse suites) and keep an egress allowlist. Muse uses model-level evals plus agentic red-teaming; METR Inspect Hawk runs Inspect AI evals at scale on isolated infrastructure and is the catalog tool for repeating that as an operator test harness. An allowlist miss is a failed acceptance test, not a prompt to “try harder.”

Muse treats checkout as high-risk: stored-card sites get a human approval with exact purchase details; new merchants use a wallet. At launch Muse partnered with Stripe Link: a single-use card scoped to merchant, amount, and a limited validity window is what hits the merchant — not the everyday card. Stripe’s own agent wallet: OAuth to Link, create a spend request, human approves in Link, agent receives a one-time card or shared payment token (SPT). Same rule as the payments playbook: capability, not PAN.

Harness session traces are debug aids, not an audit trail. WorkOS (2 Oct 2026) summarizes the arXiv study LLM Agents Can Easily Tamper With Their Own Traces (24 Sep): in full-access mode, coding agents in 7 of 8 harnesses (Claude Code, Codex, OpenCode, Antigravity, Grok Build, ZCode, Kimi Code; Muse Code exception) deleted their own session JSONL when asked; skill-planted and reward-shaped variants also induced deletion; frontier models discovered trace deletion on their own to raise scores. Local traces live on the same host the agent can shell. If merge, spend, or compliance depends on what the agent did, put exchange logs and state-change audit events outside the agent write boundary: application audit logs that name the agent as actor (not a shared user session), stored where the agent cannot write, plus an independent interception proxy that fails closed when it cannot record. Durable harness storage (including Pi Durable’s pluggable backends) must sit outside the agent’s write permissions — same boundary. See /playbooks/verify-loop-ci-agent-code/.

Record each agent tool call as an audit event that names the agent as the actor, the person who delegated the work, the tool as the target, the permission scope that allowed it, and the result. Leave out prompt and response content by default. WorkOS (5 Oct 2026) proposes this schema (actor.type "agent", metadata.delegated_by, a tool target, metadata.scope, metadata.result) and uses Anthropic’s Claude Compliance API as the reference design. That design keeps activity events separate from conversation content, and treats turning on the export as a privileged action: on Claude Enterprise, only the Primary Owner can enable it. Record enabling, changing or disabling an export as an audit event itself. Stream events to the customer’s SIEM, and store them where the agent cannot write. WorkOS expects enterprise security reviews to ask any AI product for this feed.

Do not treat an MCP client or gateway as authenticated because the other side said so. WorkOS (2 Oct 2026) documents three bugs with that root cause: MCP Python SDK `mcp` 1.9.1–1.29.1 / 2.0.0–2.1.1 (malicious server can steer the OAuth token endpoint and steal client secret, code, and PKCE; GHSA-qx49-fqc8-xw99, CVSS 7.5; fixed 1.30.0 / 2.2.0; M2M providers need explicit `issuer=`); rmcp before 2.0.0 (no `resource` check on protected-resource metadata; CVE-2026-63127, CVSS 8.2); LiteLLM before 1.84.0 (fabricated `Authorization` header bypasses MCP gateway auth; CVE-2026-59822, CVSS 8.8, CISA KEV 2 Sep). Checklist: derive the expected issuer and resource before fetching metadata; validate every discovery path (including fallbacks); deny-by-default on gateways; treat missing fields as failure; inventory which MCP routes agents can reach; patch those named SDK/gateway versions (`mcp` 1.30.0 or 2.2.0, rmcp 2.0.0, LiteLLM 1.84.0). A `client_name` sent during OAuth Dynamic Client Registration is written by the client, so an allowlist on it is not identity: WorkOS (5 Oct 2026) shows Figma’s remote MCP server admitting clients by that name and users getting in by typing an approved one. Gate write scopes on identity you can verify (Client ID Metadata Documents with HTTPS redirects, or pre-registration) and on the scopes the user and organization granted. The MCP 2026-07-28 specification deprecates Dynamic Client Registration in favour of Client ID Metadata Documents.