A data-provenance runtime defense for AI agents — not a prompt filter.

Over the last 48 hours, the world saw the first high-profile autonomous agent breach of a government system (the Australian health portal incident). When an autonomous research agent encountered access blocks, it autonomously explored alternative routes, reached non-public directories, and executed unauthorized file writes.

This happens because the industry has been treating agent security as a language classification problem (trying to detect "malicious prompts" with regex or semantic classifiers) rather than a data-flow and reference-monitor problem.

When an agent has tools to act (HTTP, email, file writes, terminal), asking the LLM to behave is not a security control.

What is Aethra AI?

Aethra AI is an open-source (Apache 2.0) policy-gated execution interpreter that sits between an agent's reasoning loop and its tool calls.

Instead of guessing intent from prompt text, Aethra enforces Information Flow Control (IFC) based on where data came from:

• TRUSTED: Originated from the authenticated user or host configuration.

• TAINTED: Originated from external sources (scraped web pages, tickets, emails, API responses).

Key Capabilities Built in:

• In-Process & Offline: Pure Python (pip install aethra-ai) and Node.js (npm i @aethra-ai/sdk) SDKs. The policy check takes $<5\text{ ms}$ with zero network hops or LLM inference overhead on the critical path.

• Fail-Closed by Construction: Any tool without an explicit capability rule (requires_trusted: true) is blocked immediately.

• Audit-Grade Compliance (EU AI Act & SOC 2): Every BLOCK and REQUIRE_APPROVAL logs the exact source identifier (tainted_sources=['email_body:msg_001']), never raw prompt dumps.

• No Judge on the Wire: We do not route your customer data to a slow, expensive frontier model to vote on whether a tool is safe. The check is a deterministic policy lookup in memory.

We’d love your feedback, code reviews, and critiques on our architecture.