‘Handles’
Patent pending secure, ontological containment for AI Agents.
AI agents are transforming business operations, but their non-deterministic nature makes them inherently difficult to secure. Traditional security models are failing to keep up. The Handles Runtime provides a mathematically verifiable way to ensure AI agents always operate within strict corporate boundaries.
01 / THE PROBLEM
Agentic AI is being wired directly into production infrastructure, code and live credentials. Unlike traditional software, an agent does not follow a fixed logic path: it picks whatever action seems likely to achieve its goal, so the same authority that fixes a bug can just as easily delete a database. This is not theoretical.
In July 2025, a Replit AI agent deleted a live production database during an active code freeze, wiping records for over 1,200 executives and 1,190 companies. In April 2026, a Cursor agent running Claude Opus 4.6 deleted PocketOS’s entire production database and every backup in one nine second API call, reusing a credential on its own initiative. No attacker was involved: the agent used legitimate credentials and approved tools to do what it decided, in the moment, was right.
These incidents share a common structure that current approaches to agent security are not built to address. Traditional access controls such as RBAC and ABAC express policy but are not unforgeable, while OAuth scopes are neither true capabilities nor ontology typed. Classic object-capabilities are unforgeable but semantically opaque, so the system cannot reason about the authority they carry, and conventional agent security spreads trust across every tool integration, prompt path and dependency rather than concentrating it. Because AI agents are non-deterministic, they are highly susceptible to prompt injection, jailbreaking, goal manipulation, tool abuse, privilege escalation and authority laundering attacks, and, as the incidents above show, to their own flawed reasoning acting entirely on its own initiative.
02 / THE SOLUTION – HANDLES RUNTIME
The Handles Runtime is a verified object-capability runtime that transforms the agent-to-world boundary into a strict reference monitor. Every resource, tool, credential and sub-agent the AI touches is exposed as a Handle: our patent pending, unforgeable reference bound to a canonical type in a shared ontology. Unlike a classic capability, a Handle forces the authority it carries to declare its explicit meaning, so the runtime can mechanically reason about, and enforce, exactly what is permitted at the precise point of use.
Rather than spreading risk across every integration, tool and dependency the way conventional approaches do, this model concentrates the entire security guarantee into one small, verified core that cannot be bypassed. That core is what would have stood between the agents in the incidents above and the destructive commands they were able to issue: even with a valid credential in hand, an agent can only exercise the exact, type-constrained authority its Handles carry. Integration is straightforward: existing enterprise systems are wrapped as Handles, requiring absolutely no modification to the underlying AI agent models themselves.
02 / KEY BUSINESS BENEFITS
The containment guarantee: even if an AI agent is fully compromised, whether through prompt injection, jailbreaking or malicious code, or simply reasons its way to a destructive conclusion on its own, it can only exercise the exact, type-constrained authority its Handles carry.
● Automated, real-time auditing: every grant, attenuation and resource use is tracked as a provenance fact in a shared ontology. Governance and compliance tracking become instant mechanical queries rather than messy, after the fact reconstructions.
● Zero policy drift: the exact same ontology-grounded constraint is consumed by both real-time runtime enforcement and formal reasoning, ensuring compliance rules and actual execution never drift apart.
● Provable security scaling: the challenge of securing unpredictable AI is reduced to a bounded, mathematically checked theorem at the most critical point of trust. Agents can safely grow more capable without widening the corporate risk boundary.
