Agentic Action Runtime Pack

What this is. SecurityRecipes is positioned as The Secure Context Layer for Agentic AI. This pack turns that context into a runtime action gate: before an agent writes a branch, changes scope, delegates to another agent, writes memory, installs a skill, deploys to production, or touches irreversible systems, the host can ask for a deterministic allow, hold, deny, or kill decision.

Rechecked source anchors against the public MCP specification 2026-07-28 on August 21, 2026.

The product bet

The next reviewer question is not “do you have agent security docs?” It is:

Can you stop an autonomous action before it becomes an incident?

The Agentic Action Runtime Pack is the answer. It binds six pieces of evidence before action:

  1. Context - the source package and trust state the agent used.
  2. Policy - the workflow, MCP gateway, authorization, egress, handoff, memory, and skill boundaries.
  3. Intent - the declared action class and purpose for this run.
  4. Behavior - runtime indicators, telemetry, changed paths, data classes, and high-impact flags.
  5. Identity - the delegated non-human identity and owner.
  6. Receipt - the run receipt, approval, risk acceptance, and correlation id needed to reconstruct the decision.

That is the trusted-source control point. The open site creates trust and distribution; the production MCP server can become the hosted action firewall that enterprises put in front of agent hosts.

Workflow at a glance

Agentic Action Runtime Pack workflow

Bind context, policy, intent, behavior, identity, and receipts before an agent performs a side effect.

agent-runtime

  1. Signal

    Capture action intent

    Record the action class, target, arguments, purpose, expected effect, workflow, run, and requested authority.

  2. Scope

    Assemble decision evidence

    Bind trusted context, policy versions, identity, entitlement, telemetry, approvals, and prior run receipts.

  3. Decision

    Evaluate runtime rules

    Check scope, data classes, changed paths, delegation, memory, skills, production impact, and irreversible effects.

  4. Action

    Enforce the decision

    Allow, require approval, hold, deny, or kill before the host dispatches the action to its tool.

  5. Proof

    Persist the action receipt

    Record inputs, evidence hashes, reason codes, policy, effect status, and correlation chain.

Decision gate

Is this action authorized, evidence-complete, inside workflow scope, and free of hard-stop signals?

Proceed

Execute only the declared action and append its receipt.

Hold or stop

Hold, deny, or terminate before side effects when any binding or runtime control fails.

Evidence to retain

  • bound context/policy/identity evidence
  • runtime decision and reason codes
  • action effect receipt

Expected outputs

  • action decision record
  • approval request
  • kill/containment record

What was added

  • data/assurance/agentic-action-runtime-profile.json - source contract for action classes, required evidence, standards alignment, runtime policy, and trusted-source path.
  • data/evidence/agentic-action-runtime-pack.json - generated action runtime pack for MCP clients, CI drift checks, and reviewer diligence.
  • recipes_agentic_action_runtime_pack - MCP lookup by action class, workflow, risk tier, or decision.

Evaluate a bounded repository write:

python3 scripts/evaluate_agentic_action_runtime_decision.py \
  --workflow-id vulnerable-dependency-remediation \
  --action-class repo_branch_write \
  --run-id run-branch \
  --agent-id sr-agent::vulnerable-dependency-remediation::codex \
  --identity-id sr-agent::vulnerable-dependency-remediation::codex \
  --tenant-id tenant-demo \
  --correlation-id corr-branch \
  --intent-summary "Patch dependency lockfiles on a scoped remediation branch" \
  --policy-pack-hash sha256:policy \
  --authorization-decision allow_authorized_mcp_request \
  --receipt-id receipt-branch \
  --expect-decision allow_bounded_action

Evaluate a secret-bearing action:

python3 scripts/evaluate_agentic_action_runtime_decision.py \
  --workflow-id sensitive-data-remediation \
  --action-class credential_or_secret_access \
  --run-id run-secret \
  --agent-id sr-agent::sensitive-data-remediation::codex \
  --identity-id sr-agent::sensitive-data-remediation::codex \
  --tenant-id tenant-demo \
  --correlation-id corr-secret \
  --intent-summary "Inspect whether a candidate finding contains a token" \
  --policy-pack-hash sha256:policy \
  --authorization-decision allow_authorized_mcp_request \
  --egress-decision hold_for_redaction_or_dpa \
  --receipt-id receipt-secret \
  --contains-secret \
  --expect-decision kill_session_on_runtime_action_signal

What is inside

Section Purpose
action_runtime_summary Action class count, workflow coverage, decision-floor distribution, high-impact action count, evidence source count, and failure count.
action_contract Default fail-closed state, required runtime fields, required evidence sources, and decision ladder.
action_classes Runtime action classes for branch writes, production deploys, identity and scope changes, secrets, egress, remote agent delegation, memory writes, skills, registry quarantine, and irreversible transactions.
workflow_action_matrix Per-workflow action envelopes derived from the workflow manifest and MCP namespace coverage.
runtime_policy Approval requirements, kill indicators, and the evidence gate agents must satisfy before the action is trusted.
tabletop_cases Ready-made allow, hold, deny, and kill cases for platform testing.
source_artifacts Hashes and paths for the evidence packs used to build the runtime action model.

MCP examples

Get the executive summary and workflow matrix:

{}

Inspect an action class:

{
  "action_class_id": "production_deployment"
}

Inspect the action envelope for one workflow:

{
  "workflow_id": "artifact-cache-quarantine"
}

Find critical action classes:

{
  "risk_tier": "critical"
}

Evaluate one runtime action:

{
  "workflow_id": "vulnerable-dependency-remediation",
  "action_class": "repo_branch_write",
  "run_id": "run-123",
  "agent_id": "sr-agent::vulnerable-dependency-remediation::codex",
  "identity_id": "sr-agent::vulnerable-dependency-remediation::codex",
  "tenant_id": "tenant-a",
  "correlation_id": "corr-123",
  "intent_summary": "Patch package manifests on a scoped branch.",
  "policy_pack_hash": "sha256:policy",
  "authorization_decision": "allow_authorized_mcp_request",
  "receipt_id": "receipt-123"
}

Why it is review-ready

Documentation sites are useful. Runtime action control is a product.

For a trusted-source outcome, SecurityRecipes needs a path from open knowledge to a production control plane that frontier labs, AI coding platforms, and cloud security vendors could integrate. This pack is that path:

  • hosted action firewall APIs for agent hosts and MCP gateways,
  • signed action receipts,
  • customer policy adapters,
  • approval and risk-acceptance validation,
  • SIEM/SOAR export,
  • high-impact action inventory,
  • runtime drift detection,
  • reviewer-ready evidence for autonomous action governance.

It also makes AI easier. Security teams do not need to write bespoke agent policy from scratch; they can start from a concrete action envelope and tune the thresholds.

Industry alignment

The pack is anchored in current primary guidance:

See also