A Polygraph engine · agent security

polyman — the call that completes the leak, refused before it runs

An agent can take ten individually allowed actions whose combination is the leak, and no per-call filter can see it. polyman sits between the agent and its tools, tracks what the session has already touched, and refuses the one call that would complete the leak. Enforcement, not advice — the policy it enforces is the one polysec checked on every path before it shipped, and nothing on its decision path can be talked into the wrong answer.

The GitLost shape, at runtime

In July 2026 Noma Labs showed GitHub Agentic Workflows leaking a private repository: an injected instruction in a public issue, a private read the agent was entitled to make, and a public comment. Every call was individually allowed — the coexistence was the leak. The full case is on the polysec page.

Every agent framework now ships a tool-approval hook to sit in front of exactly this. They share one weakness: the policy inside the hook is a hand-written if, and nobody checked that it holds on every reachable combination of tool calls. That is the gap polyman is built to close.

What you get

A gate that cannot be talked out of its job. polyman steps the checked policy before every call — nothing runs first — and when the next call would put the session into a state it must never reach, that call fails. The agent sees an ordinary failed call; the journal sees which rule, and why.

A checked machine, not a hand-written if

What polyman holds the agent to at runtime is the same mandate polysec checked before the run — there is no second policy to drift out of sync. No model or network call sits on the decision path, so the thing deciding whether a call runs cannot itself be talked into the wrong answer.

Tool-approval hook — today

  • Policy is a hand-written if
  • Checked against the cases someone imagined
  • No proof it holds on every reachable combination

polyman

  • Policy is the mandate polysec checked
  • Denies the call that would complete the leak
  • Deterministic — no model on the decision path
#AIAgents #PromptInjection #FormalVerification #StateMachines #LLMSecurity

Adapted from “Your Agent Is Lying to You,” Jean-Jacques Dubray.

Govern the agent
Governing agents → All tools →