Harness: Permission Outside the Agent
The agent proposes; a host authority grants connectors, egress, and spend
Operator recipe from Meta’s Muse Secure VM pattern: keep permission outside the model. Sentinel (or an equivalent host authority) is the sole grantor of connector actions and network egress. The agent proposes; it does not approve. Credentials live in a vault; the runtime sees only surrogates until the host inserts the real token at an authorized boundary. Human approvals are scoped capabilities (one use, session, task, window, or standing grant) — not a chat “yes.” Treat behavioral evals and egress allowlists as acceptance tests before widening autonomy. Purchase path: single-use scoped cards (Muse partners with Stripe Link at launch; Stripe’s agent wallet issues a one-time card or shared payment token after a spend request). Primaries: Meta AI Muse security blog; Meta “Introducing Muse” (about.fb.com / Meta Newsroom); Stripe “Giving agents the ability to pay.” Related catalog tools: Stripe Link, METR Inspect Hawk, OpenAI Agents SDK (in-app harness, not the managed Agents API).
Core Workflows (6)
Each workflow represents a critical business function. Click any workflow to see detailed automation architecture.
Host authority is the sole grantor
Led by: Host Authority (Sentinel)Run a Sentinel-class host-side authority separate from the agent cell. It alone grants connector methods and all network egress. Muse: the agent proposes; only Sentinel can grant. Replicate that split even if you are not on Muse — the OpenAI Agents SDK is an in-app harness you host; it is not OpenAI’s managed Agents API.
Agent proposes; host evaluates
Led by: Proposing AgentConnector calls submit connector, method, action class, scope, and user-task context to the host. The host evaluates policy and allows, denies, or asks the human. Egress is inspected at L4 and L7 (hostname, resolved IP, port, protocol, method, path, decoded request), including SSRF protections so a public name cannot resolve to private infrastructure.
Vault plus surrogate tokens
Led by: Host Authority (Sentinel)Real secrets stay in a vault/auth daemon. Runtime code sees surrogate tokens. After the host authorizes a concrete request, it replaces surrogates with the real credential at the network boundary. Workers get explicit credential allowlists (a calendar worker cannot fetch an email token by rewriting a parameter). Prompt-injection cannot reveal a secret the agent never saw.
Human approvals as scoped capabilities
Led by: Approval OperatorWhen the host asks the user, the prompt is a client dialog describing the exact action — not a free-form chat reply the model can reinterpret. Grants can be one-use, session, task, time-window, or standing, and later requests must stay inside that scope. Tainted egress (process read untrusted/user data) drops auto-allow and falls back to approval.
Evals and egress allowlists as acceptance tests
Led by: Eval OperatorBefore widening auto-allow, run behavioral evals (prompt-injection / tool-abuse suites) and keep an egress allowlist. Muse uses model-level evals plus agentic red-teaming; METR Inspect Hawk runs Inspect AI evals at scale on isolated infrastructure and is the catalog tool for repeating that as an operator test harness. An allowlist miss is a failed acceptance test, not a prompt to “try harder.”
Purchase path via single-use scoped cards
Led by: Purchase Path OperatorMuse treats checkout as high-risk: stored-card sites get a human approval with exact purchase details; new merchants use a wallet. At launch Muse partnered with Stripe Link: a single-use card scoped to merchant, amount, and a limited validity window is what hits the merchant — not the everyday card. Stripe’s own agent wallet: OAuth to Link, create a spend request, human approves in Link, agent receives a one-time card or shared payment token (SPT). Same rule as the payments playbook: capability, not PAN.