Agentic Cognitive Firewall: Zero-Trust Security SDK for Agentic AI

Problem Statement

• Agentic AI systems are exposed to direct and indirect prompt injection at multiple points beyond the user-facing prompt — retrieved RAG context, tool calls, and memory reads and writes can all carry unsafe instructions.
• In-process safeguards are unreliable once the agent process itself is compromised, since detection and enforcement logic sharing that process can be bypassed or disabled along with it.
• Production deployments need policy decisions fast and deterministic enough to sit inline on every agent action, not offline or best-effort filtering.

What I Led

• Designed a split-process architecture — a thin Python SDK inside the agent process that signs and forwards payloads, paired with an isolated Go sidecar holding all detection and policy logic — so enforcement survives a fully compromised agent.
• Built a six-stage detection pipeline ending in an embedded OPA/Rego policy engine that returns allow, sanitise, or block decisions within a 4–8 ms budget.
• Added an optional sentence-transformer-based semantic scanner for catching injection attempts that evade static pattern rules.
• Shaped the SDK as an open-source, framework-agnostic foundation for zero-trust agentic deployments, released under the C2SI open-source organization.

Deliverables

• Split-process enforcement architecture (Python SDK + isolated Go sidecar)
• Six-stage detection pipeline with an embedded OPA/Rego policy engine
• Optional sentence-transformer semantic scanner for prompt injection detection
• Open-source SDK for production agentic deployments

Tech Stack