Agent Security Policy (ASP): The Missing Trust Boundary Layer in Agentic AI Systems

Twenty-five years of browser security produced one genuinely durable idea: move enforcement out of the application and into a layer the application cannot touch. Content Security Policy worked because browsers, not JavaScript, decided what was allowed. The application could not override the policy because it had no access to the enforcement mechanism.

AI agents do not have this. An agent's policy lives in its system prompt, which sits in the same context window as user messages, tool responses, and retrieved documents. A crafted instruction in a retrieved file can conflict with the system prompt, and the model resolves that conflict using inference.

There is no separate process making the call. This paper focuses on two primary gaps: the absence of an enforcement boundary analogous to the browser kernel layer, and the lack of a standardized machine-readable policy format. A third gap, violation observability, follows from the first two.

The proposal, Agent Security Policy (ASP), is an infrastructure pattern closer to a security header than a training objective, defining what a trustworthy enforcement boundary for agents would actually require.