Agent-assurance-lab

"An autonomous agent can't make reliable decisions on user prompts alone. To act safely, it needs structured context about four key areas: Explicit Tool Contracts: The agent must know what tools actually do, distinguishing between read-only actions, state changes, and network activity rather than relying on basic descriptions. System State & Invariants: It needs clear visibility into active security policies, denylists, and schemas that define system boundaries. Environment Topology: It must distinguish between logical names and resolved network endpoints to recognize public versus private targets. Execution Feedback: Instead of assuming an API call succeeded, it requires verifiable receipts and cryptographic proof of completion."