The AI Security Triad

The three roles

For decades, application security assumed one enforcer: the tool watching the process. AI agents broke that model. An agent asked politely to do something harmful will usually do it. An agent prompted to ignore its own guardrails often will. The tool watching from outside the agent cannot see what is happening inside its reasoning.

The AI Security Triad answers this with three independent roles. Any one of them can be compromised, misled, or talked into the wrong thing — and the other two still reach the right answer.

Operator

You. Holds the intent and the authority, and keeps the right to override any verdict.

Agent

Your AI agent. Security-aware. Takes its bearings from the Authority Anchor before it acts. Cites policy under pressure.

Authority Anchor

Dryx. A deterministic, offline, isolated source of truth. It cannot be prompt-injected, because it never reads the prompt.

↓ Consensus before any action ↓

The closed loop

Dryx inspects. A deterministic inspector maps what every AI agent on your machine can reach — secrets, MCP servers, instruction files, schedules, endpoints.
It informs the Operator. Findings surface with severity and remediation. You see the exposure before an incident does.
It updates the Agent's context. Hardened security directives get written into the agent's instruction surface in a way that preserves your own content around them.
The Agent anchors to the Authority Anchor. Before it installs an MCP server, before it modifies a config, before it touches anything that matters — the agent calls back to Dryx for an offline verdict and surfaces it to you.
Three roles verify independently. No single point of enforcement, so no single point of failure.

The honest part. The agent's deference is mechanical, not voluntary — on the direct-download (notarized) build, a local helper checks the action at the harness hook, and an action on the precomputed-dangerous set is blocked. App Store builds run sandboxed: there Action Guard's Enforce state can't arm, so the deference is a taught reflex plus passive monitoring. The gate reads the action, not the argument — a prompt injection can win the argument with the model and still lose to the gate.

Deterministic enforcement of the precomputed-dangerous set where the harness supports a hook; defense-in-depth everywhere else. It does not take all risk away. — See how the runtime authority works →

Why this matters now

AI agents are among the fastest-growing attack surfaces a developer runs locally, and the market has started pricing that in. In 2026, Palo Alto Networks acquired Koi for roughly $400 million to add a category it calls Agentic Endpoint Security — agent visibility, but in the cloud. That leaves the offline developer workstation, where the agent actually runs, open below it.

The exposure is real and public. Security researchers have reported MCP server ecosystems with 150M+ package downloads and 7,000+ public servers, and a pattern of remote-code-execution and over-broad-OAuth findings across them. One over-permissioned token becomes a master key the moment the tool holding it is compromised.

The category needs a name. The problem has three parts: agents that can be talked into unsafe actions, security tools that cannot see inside agent reasoning, and operators who cannot audit the permissions their tools have quietly accumulated. The AI Security Triad names the shape of the defense — independent verification across all three roles.

How Dryx implements the AI Security Triad

Today, on macOS, across every AI agent on your machine — Claude Code, Claude Desktop, Cursor, Codex CLI, Cline, GitHub Copilot, Windsurf, Gemini, Ollama, and any MCP-capable agent — under one Authority Anchor:

Context Shield writes hardened security directives into agent instruction contexts (CLAUDE.md, AGENTS.md, .cursorrules, and others) inside marked, verifiable boundaries that preserve your own content. Agents become security-aware without Dryx being in the runtime critical path.
Authority Anchor MCP exposes Dryx's live posture to agents through a read-only Model Context Protocol server. Seven tools — get_overview, get_posture, list_findings, analyze_skill_or_mcp, check_mcp_server, check_action_allowed, and report_reasoning — including an action-boundary check and an attestation receipt for every decision. No cloud calls: it reads the local inspection and nothing else.
Action Guard watches changes to MCP servers, skill definitions, and instruction files, with three states — Off, Observe (the first-run default: surface and log, change nothing), and Enforce (block actions on the precomputed-dangerous set at the harness hook). Enforce arms on the direct-download build; everything has an explicit Operator-override path.
Skill Shield analyzes extensions before install and projects their impact on your specific workspace — the pre-deployment layer of the Triad.
Behavioral baseline is a precomputed exposure input the policy compiles from. The slow path does the heavy analysis once; the hot path just checks the answer. It covers more, it never thinks more.
Verified in CI. Detector, sanitizer, and canary secret-leak suites run on every commit. See the receipts → All green.

Patent-pending across 11 filings

Multi-party consensus · Policy directive injection · Adversarial-request resistance · Behavioral baseline · Orphaned-configuration detection · Pre-deployment blast radius · Multi-layer enforcement — the seven Authority-Anchor filings, plus 4 prior cybersecurity provisional filings. Priority date April 2026. Inventor: Matthew Jackson. See the filings →

What the AI Security Triad is not

Not a single policy engine. A single point of enforcement is still a single point of failure. The Triad needs three independent roles.
Not an LLM guardrail. An LLM-based safety layer cannot be the ground truth, because it can be prompted against itself. The Authority Anchor has to be deterministic and never read the prompt.
Not a wrapper around the model. Dryx stays outside the agent. It exposes data and renders verdicts; it does not act on the agent's behalf. The agent moves; Dryx stays put.
Not enterprise cloud posture management. The Triad runs where the agent runs — on the Operator's machine, at the agent's context layer, offline.