# Agentic AI Containment Architecture for Security Hardening

arXiv: https://arxiv.org/abs/2608.26108 · HTML: https://mlsanity.com/paper/2608.26108/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 4 of its 10 references that are in the map.
- First posted on arXiv 12 May 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 4 of 4)

- [TRiSM for Agentic AI: A Review of Trust, Risk, and Security Management in LLM-based Agentic Multi-Agent Systems](https://mlsanity.com/paper/2506.04133/) (2025)
- [Agentic AI: A Comprehensive Survey of Architectures, Applications, and Future Directions](https://mlsanity.com/paper/2510.25445/) (2025)
- [Emergent Coordination in Multi-Agent Language Models](https://mlsanity.com/paper/2510.05174/) (2025)
- [Guarding the Guardrails: A Taxonomy-Driven Approach to Jailbreak Detection](https://mlsanity.com/paper/2510.13893/) (2025)

## Abstract (arXiv)

Multi-agent AI systems are increasingly deployed in contexts where autonomous coordination, tool use, and continuous learning introduce novel security and governance risks. The containment approach to multi-agent system security remains underdeveloped, primarily resorting to add-on layers post-design and sometimes post-implementation and deployment. This paper proposes an Agent Containment Architecture that treats security as an architectural property enforced through a set of explicit constraints that bound the design space of multi-agent systems. The architecture proposed in this paper introduces a novel formal organizational mapping from standard systems analysis artifacts to machine-verifiable contracts under a proposed constraint system. The architecture introduces six interacting constraints: separation of responsibility assignments, pre-deployment coherence checking, value stream binding, temporal isolation, strict knowledge verification before accumulation, and deterministic verification of structural and process integrity. Together, these constraints enforce a Propose-Verify-Act-Verify execution model in which all operations are contractually defined, independently verified, and traceable to specific execution contexts. The paper presents propositions and correctness reasoning arguments linking these constraints to defenses against key threat classes, including prompt injection, orchestrator manipulation, cross-session state poisoning, and emergent agent collusion. A resume screening case study demonstrates how the architecture produces auditable, policy-compliant outcomes under adversarial conditions. The work explicitly separates structural integrity from semantic safety, bounding residual risks while making residual semantic risk explicit and measurable.