Architectural specification and formal verification standards for sub-35µs in-process gating, Non-Human Identity (NHI) capability passkeys, and automated SOC 2 Type II / EU AI Act Article 14 evidence packs.
The rapid deployment of autonomous AI agents (Claude Code, Cursor Composer, Windsurf Cascade, AutoGen, CrewAI, LangChain) has created an unprecedented attack surface for enterprise organizations. Unlike traditional chat interfaces, agentic systems possess tool-dispatch capabilities: the authority to execute bash commands, query production databases, mutate filesystem trees, and interact with external network services.
Relying on model-level alignment ("system prompt instructions") is fundamentally insecure against indirect prompt injections, jailbreaks, and adversarial context poisoning. Bartholomew establishes the Agentic Runtime Protection (ARP) layer: an in-process, deterministic Abstract Syntax Tree (AST) gate operating strictly before the operating system and database boundary.
"No autonomous LLM decision may execute at the operating system or data layer without synchronous, compiled invariant validation and cryptographic Non-Human Identity (NHI) proof."
Traditional cloud-based proxy firewalls introduce 200ms–500ms network round-trip overhead and expose proprietary source code to third-party eavesdropping. Bartholomew compiles polyglot AST validators directly into the agent's host memory runtime (Node.js and Python), executing in 14.2 µs (median) with zero cloud egress.
| Security Layer | Conventional Agent Gateway | Bartholomew ARP (BTP v6.4.4) |
|---|---|---|
| Execution Location | Remote Cloud Reverse Proxy | In-Process Host Enclave (Zero Egress) |
| Latency Overhead | 150 ms – 450 ms (Network hop) | 3.2 µs – 18.5 µs (Compiled AST) |
| Credential Scrubbing | Post-hoc LLM observer scan | In-Flight Entropy Vault (<12µs) |
| Identity Model | Static User API Keys | Ed25519 Non-Human Identity (NHI) Passkeys |
| Audit Trails | Mutable plaintext log files | RFC 8785 Canonical JSON Merkle Roots |
Bartholomew enforces 15 deterministic invariants across all tool calls and terminal executions:
| Pillar | Invariant Scope | Enforcement Mechanism | Latency |
|---|---|---|---|
| 1. Shell Destruction Gate | Blocks rm -rf /, mkfs, root filesystem wipes |
AST Lexical Tokenization | 18.2 µs |
| 2. SQL DDL Guard | Intercepts DROP TABLE, TRUNCATE, schema wipes |
SQL AST Parser & DDL Veto | 16.1 µs |
| 3. High-Entropy Secret Masker | Scrubs OpenAI, Anthropic, AWS, GitHub, Stripe keys | In-Flight Regex & Zero-Leak Ref | 12.4 µs |
| 4. Keystone Passkey Leases | Attenuated capability grants with spend limits ($25.00/day) | Ed25519 Non-Human Identity | 21.0 µs |
| 5. Cloud SSRF Shield | Blocks exfiltration to 169.254.169.254 instance metadata |
Network Socket Inspection | 10.9 µs |
| 6. Fork Bomb Interceptor | Suppresses recursive shell expansion before process exhaustion | POSIX Execution Pre-Scan | 22.0 µs |
| 7. Universal Schema Harmonizer | Validates Claude, OpenAI, Gemini, OpenAPI specs without glue code | Multi-Format Schema Contract | 17.3 µs |
| 8. Merkle Audit Attestation | Immutable forensic hash chaining for continuous compliance | RFC 8785 SHA-256 Merkle Roots | 24.1 µs |
Bartholomew provides automated, machine-verifiable evidence dossiers mapping directly to global AI and cybersecurity regulatory frameworks:
| Regulatory Framework | Specific Requirement | Bartholomew Compliance Guarantee |
|---|---|---|
| EU AI Act (Article 14) | Human Oversight & Autonomous Kill-Switches | Deterministic AST veto gates and dual-key human co-signature for irreversible mutations. |
| EU AI Act (Article 15) | Cybersecurity, Robustness & Attack Immunity | In-process compiled gates immune to prompt injection, model jailbreaks, and context poisoning. |
| SOC 2 Type II (CC6.1 & CC6.6) | Logical Access & Boundary Protection | Cryptographic Non-Human Identity passkeys restricting agents strictly to authorized workspace boundaries. |
| SOC 2 Type II (CC7.1 & CC8.1) | Change Management & Forensic Non-Repudiation | Tamper-proof append-only Merkle ledger with SHA-256 hash chains across all agent actions. |
| NIST AI RMF 1.0 | GOVERN 1.2, MAP 2.3, MEASURE 2.6 | Continuous empirical red-team fuzzing and per-action capital ceilings ($5.00/call). |
| ISO/IEC 42001:2023 | AI Management System Controls (A.6.2 & A.8.4) | Formal silicon provenance attestation and air-gapped SCIF audit verification. |
Every deployment of Bartholomew produces an independently verifiable JSON evidence dossier signed by the Bartholomew Sovereign Trust Authority. The current active production certificate:
{
"report_id": "urn:btp:audit:soc2:v630:e0e2fd7e0d39e63f",
"protocol_version": "BTP/6.4.4",
"compliance_score": 100.0,
"compliance_grade": "A+",
"auditor_authority": "Bartholomew Sovereign Trust Notary & Sentinel",
"merkle_root": "71b3fdd56d57a7f8ebbf93c3c82ed511103cc925ac7445b860887ebbcd92445d",
"content_digest_sha256": "1269eff431a8bbcf3692d72533d1774445eab93a0e803e1b04c329499b476203",
"cryptographic_signature": "4bba4ce92bf04954772414707449cc29...",
"status": "COMPLIANT_IN_PRODUCTION"
}
Issue a cryptographically attested, single-tenant 30-day trial license token for your internal security team to test sub-35µs AST protection against autonomous coding agents.
Bartholomew Agent Guard is an open-source public good licensed under the MIT License.
For enterprise air-gapped deployments, custom invariant policies, and dedicated SOC 2 support: security@bartholomew.info • https://bartholomew.info