An agent can follow a procedure and still produce an unauthorised effect. The outcome depends on the procedure’s origin, the available tools and the control applied when information leaves or a resource changes. Model quality matters; it does not establish these conditions.
I use armature to describe the organisation of context, methods, tools, decisions and observations around an agentic use case. This is my architectural framework, not a certification standard. It directs attention to relationships between components rather than the number of installed tools.
A maintenance runbook becomes an export instruction
Consider a team authorising an agent to investigate an outage. Its context includes a runbook retrieved from a document space. An alteration asks it to assemble a diagnostic archive and send it to a new support address. That archive may contain configurations, machine names and secrets present in logs.
The agent has both an archiving tool and a network tool. If it treats the runbook as permission, documentary content indirectly acquires the power to expose those data. The failure crosses retrieval, method selection, file preparation and transmission. A check limited to the final message displayed to the user would arrive after disclosure.
A document may explain how to prepare an operation. It does not, by itself, decide who can authorise it or who may receive its data.
The process must distinguish the initial request, encountered content and authority for action. Preparing an archive may remain useful; transmission requires an authorised destination and compatible contents. A reachable address or valid API key does not settle that issue.
Relationships within the armature
Context describes the mission, resources and constraints. Skills formalise methods and their conditions of use. Tools define technically possible actions. Control points examine preconditions before effects they can prevent. Orchestration allocates tasks, decisions and recovery. Observation retains events needed for investigation. Information governance tracks sources, versions, access and subsequent use.
Identity and authorisation cut across this arrangement. A role name does not authenticate an instance; an authenticated instance does not acquire every permission needed by its proposals. NIST SP 800-207 distinguishes authentication and authorisation and rejects implicit trust based only on location.
These elements do not form a universal ladder where adding a layer guarantees success. Another tool can introduce a bypass. External observation needs protection and adequate coverage; logical separation does not make it immutable. A control relying on AI analysis retains the limitations of that analysis.
Bind controls to actual effects
For the maintenance task, the process needs the consulted runbook version, its origin, the archive contents and the recipient before transmission. Refusing one transfer channel should not leave another uncontrolled tool able to perform the same export. Residual risk depends on the available paths.
The OWASP AI Agent Security Cheat Sheet recommends limited privileges and separation between proposal and execution checks. Citing those principles does not establish their implementation.
Recovery matters too. Withdrawing a procedure does not recall contexts already delivered. Blocking a new send does not undo an earlier transmission. A network error may leave the outcome uncertain; the next decision must preserve that distinction.
Swarm’s place
Swarm is my development environment for linking plans, tasks, responsibilities, validations and evidence. Its Rust contracts include validation-evidence checks and a Trust core binding actions to mandates and parameters. The Trust pilot produces simulated effects. Biba and Bell–LaPadula mechanisms address selected integrity and confidentiality boundaries; their presence does not establish control of every memory, tool or output.
The intended armature therefore extends beyond orchestration. It also needs integration with resources, secret handling, and operating-system and network protections. Swarm’s engine alone establishes neither global confinement nor certification of this architecture.
The Swarm repository exposes these contracts for examination. For a particular operation, the useful questions are which data were used, which authority remains valid and which component can still prevent an unauthorised effect.