> For the complete documentation index, see [llms.txt](https://whitepaper.gopluslabs.io/goplus-network/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://whitepaper.gopluslabs.io/goplus-network/ai-security/agentguard.md).

# GoPlus AI Security

## Overview

GoPlus AI Security is the Security for AI direction of the GoPlus strategy. It protects AI applications and autonomous agents at three control points: **access**, the information flowing between users, applications, models, and tools; **action**, what agents are allowed to do at runtime; and **validation**, whether those controls actually hold under attack.

AI agents are no longer passive assistants. They can browse, write code, read files, call MCP tools, execute shell commands, manage credentials, deploy applications, and trigger Web3 transactions. This creates a new security challenge: the most important security decision often happens at runtime, immediately before an agent performs a high-impact action, and the information that shapes that decision flows through models, data sources, and tools that may be untrusted.

GoPlus AI Security is built around one idea: the security boundary around AI should be visible, provable, controllable, and auditable.

| Control point  | Governs                                                   | Capability               | Outcome                                                                     |
| -------------- | --------------------------------------------------------- | ------------------------ | --------------------------------------------------------------------------- |
| **Access**     | Users, applications, models, and data flows               | AI security gateway      | One controlled entry point for enterprise AI, with information-flow control |
| **Action**     | Agents, tools, MCP servers, RAG, secrets, and permissions | Agent runtime protection | Asset visibility, runtime defense, and governance                           |
| **Validation** | AI systems, agents, and connected workflows               | Adversarial validation   | Red-team evidence, remediation, and retest                                  |

The three capabilities share one control plane. Policies are authored once and enforced at the gateway and at the agent runtime. Findings from adversarial validation tune both. Every decision, from a routed prompt to a blocked shell command to a red-team result, lands in a common evidence chain.

## Why AI Agents Need Runtime Security

Traditional AI safety focuses heavily on prompts and model outputs. Agent security requires more. Once an agent can use tools, the attack surface expands from text generation to execution.

A modern coding or operations agent can read the filesystem, run shell commands, call internal APIs, reach the public internet, touch credentials and cloud keys, and increasingly sign blockchain transactions. It does all of this at the speed of automation, with no built-in judgment about safety. A single poisoned skill, a prompt-injection payload buried in a web page, or one over-broad MCP tool is enough to leak secrets, wipe a disk, or drain a wallet.

Enterprises adopting AI face three questions at once:

* **Can you see it?** Which agents are running, who owns them, and which models, MCP servers, RAG stores, tools, secrets, and permissions they can reach.
* **Has it been validated?** Whether instruction hierarchy, tool approvals, RAG grounding, and non-deterministic behavior actually hold up under attack.
* **Can you control it?** Whether a dangerous action can be warned on, approved, or blocked, and whether there is a complete record afterward.

These are not three separate problems. They are three breaks in the same chain, and GoPlus AI Security is designed to close them as one loop.

## Security as Machine-Native Consumption

Autonomous systems also change the economics of security. Traditional security is applied at deployment or through periodic review, and it is purchased in fixed units such as seats or annual licenses.

Agents may require security decisions continuously. Every model call through the gateway, every tool invocation evaluated at runtime, every skill scan, every daily patrol, and every adversarial scenario is a discrete, metered security service. Usage therefore scales with agent activity rather than with the number of human users or enterprise seats.

This is why AI Security is where the GoPlus security service economy is most visible. As agents take more actions, GoPlus evaluates more of them, and that consumption is intended to settle in $GPS.

## AI Security Gateway: Managing Access

The gateway consolidates external AI access into one controlled entry point and enforces organization-aware identity and policy on every AI request and response.

**The problem.** Employees, business systems, and AI applications typically connect to different models through personal accounts, shared API keys, or independent integrations. It is hard to confirm who is using which model, sensitive data can reach an external model with no enforcement point in between, and every application rebuilds its own inconsistent guardrails. A network proxy does not solve this, because it cannot tell a prompt from a response from a retrieved document.

**How it works.** The gateway sits between users or applications and model services. Identities are organized into groups, each group carries channel authorization and a policy bundle, and every request passes through identity recognition, channel authorization, an outbound check before the request leaves the enterprise, the model call, an inbound check when the response returns, and an audit record. Content is evaluated by type, including user prompts, system prompts, retrieved RAG context, model responses, and, where tool integration is enabled, tool arguments and results. Retrieved and tool-returned content is treated as untrusted by default.

**Gateway actions.** A policy resolves to one of six outcomes: allow; observe and allow, recording evidence; tokenize and allow, redacting sensitive parts with reversible restoration on the response path; block; route to an approved private model instead of an external one; or require approval from a designated person. Enterprises can start with observe-first policies and tighten enforcement only where evidence shows it is needed.

**Core capabilities.**

* **Organization-aware access and quota governance:** one entry point, an identity per employee or system, group-based management, and quota allocation by team or user.
* **Sensitive data definition and detection:** built-in detection for personal data, credentials, and secrets, plus custom dictionaries, patterns, and document fingerprinting for organization-defined categories, executed within the customer's environment.
* **Context-aware policy:** rules evaluate what was found together with who initiated the flow, which group, the destination provider and region, the content type, and the purpose.
* **PolicyOps:** versioned policies with diffs, unit tests, a simulator that replays sanitized historical traffic against a draft, gated publishing, and rollback.
* **Monitoring, audit evidence, and reporting:** every decision is traceable by user, group, model, content type, severity, policy, and action, with alerts and SIEM export.
* **Compliance mapping:** controls mapped to GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001, ISO 42001, and the NIST AI Risk Management Framework as control evidence.
* **Model governance and routing:** an approved provider and model catalog, data-residency and region restrictions, private-model-only rules for classified data, and routing that weighs classification, policy, quality, latency, cost, and availability, with failover and per-group budgets.

**Four trust boundaries.** The gateway protects input and data security from user to AI, untrusted content security from external content and RAG to AI, output security from AI to user, and action security from AI or agent to tools, MCP servers, and APIs.

## Agent Runtime Protection: Protecting Action

Agent runtime protection is an end-to-end security capability for AI agents, from the developer laptop to production fleets. It continuously discovers agents and their dependencies, validates real attack paths, and warns on, approves, or blocks agent actions at the moment they are executed. It pairs offensive validation with runtime defense and binds the two into a single loop under one control plane.

### Discover

GoPlus inventories the AI estate the way an attacker would map it: across code repositories, cloud and model providers, and live hosts, collecting references rather than sensitive content. Framework-aware fingerprinting distinguishes common coding and operations agents and separates an agent configured in a repository from one actually running on a host. The result is the full asset graph: agents plus the models, MCP servers and tools, RAG indexes, secrets, and permissions each one can reach. This graph is the attack surface. Every skill, plugin, and MCP package is scored for trust, with content-hash tracking that catches silent malicious updates.

### Validate

Bounded, controlled validation runs against discovered assets in an explicitly authorized and isolated environment, as dry runs. Coverage includes prompt injection and instruction-hierarchy bypass, tool-approval bypass, RAG leakage, MCP escalation, secret exposure, data egress, skill and supply-chain risk, and Web3 contract risk such as wallet draining and unlimited approvals. Results normalize into Findings with severity, evidence, an owner, and a remediation-to-retest loop. Full adversarial validation is described below.

### Defend

On every protected agent, a local-first guard evaluates actions as they happen, with no source code or secrets leaving the machine:

* **Automatic guard:** hooks intercept tool calls before and after execution, blocking destructive commands, credential-file access, and webhook exfiltration, and tracking which skill initiated each action.
* **Deep scan:** static analysis across eight categories: command execution, secret access, data exfiltration, obfuscation, prompt injection, Web3 abuse, trojan and social engineering, and permission abuse.
* **Daily patrol:** scheduled posture checks covering skill integrity, secret exposure, network risk, and audit-log analysis.

Every action resolves to **allow, warn, require approval, or block**, tunable from permissive to strict, with a redacted, append-only audit log. Local scan latency is measured in fractions of a millisecond, so protection runs inside live agent workflows.

### Govern

A control plane turns thousands of local guards into a managed program: central policy distribution with the policy version recorded on every decision, approval workflows from a single inbox, per-session and fleet-wide audit timelines, and a threat-intelligence network that delivers signed advisories for malicious skills, plugins, MCP servers, packages, URLs, and prompt-injection payloads to every guard in real time.

Enterprises author their own policy: a baseline mode of permissive, balanced, or strict with per-risk-class overrides; organization-specific command patterns, protected paths, and network allow and deny lists; a trust registry pinning approved skills, plugins, MCP servers, and sources with per-capability allowlists; and private advisories distributed alongside the global feed. Because the same policy drives what the guard blocks and what validation tests, tightening a rule and proving it holds become a single action.

### Coverage and Editions

Runtime protection integrates with major coding agents through skills and pre- and post-tool hooks, and with any MCP host through MCP server integration. Threat coverage spans execution and supply chain, secrets and credentials, data exfiltration, prompt injection, agent-specific attacks such as tool-approval bypass and MCP escalation, and Web3 risks including wallet draining, unlimited approvals, and reentrancy.

It is available as a free, local-first guard for individual developers with no account required; a cloud edition for teams with central policy, approvals, audit timelines, supply-chain reputation, and the threat-intelligence feed; and an enterprise edition deployed on-premise under license, designed for offline and air-gapped operation and enterprise identity.

## Adversarial Validation: Validating the Boundary

Adversarial validation answers the question the other two capabilities depend on: does the boundary actually hold under attack?

**The problem.** Enterprises can see that policies have been configured, but cannot easily answer whether prompt injection can change an agent's instruction priority, whether tool approvals can be bypassed, whether RAG content, MCP servers, secrets, or customer data can leak, or whether a fix has actually closed the original attack path. Agent environments change constantly, and periodic manual penetration testing built for deterministic software cannot keep up.

**How it works.**

1. **Define the validation scope:** target systems, agents, tools, data, permissions, and the attack paths permitted to be tested.
2. **Establish a controlled environment:** authorization, isolation, rate limits, dry-run mode, and emergency-stop conditions. Nothing runs until these are in place.
3. **Execute adversarial scenarios:** prompt injection, tool misuse, RAG leakage, MCP escalation, secret exposure, data exfiltration, supply-chain risk, and Web3 contract risk, aligned with public agent-threat taxonomies and with the same detection rules and advisories that power runtime defense.
4. **Produce Findings:** severity, attack path, evidence, scope of impact, and owner, with benign control cases included so that false positives are visible too.
5. **Remediate and retest:** findings become policy or engineering changes, and the affected attack paths are re-validated after the change and whenever a model, prompt, tool, permission, MCP server, or supply-chain component changes.

**Responsible offensive security.** Every scenario is a dry run inside an approved scope. No scenario runs without an active, in-window customer authorization; active validation executes only on runners attested to be isolated; blast-radius rate limits and an emergency-stop kill switch apply throughout and are visible in the audit record. Adversarial validation is reserved for authorized validation of the customer's own systems and is not a general-purpose attack framework.

**Open benchmarks.** GoPlus publishes open benchmarks for agent security tools with labeled datasets across threat categories, so that detection rate, false-positive rate, precision, recall, and per-category coverage can be reproduced and compared, and uses the same framework to evaluate autonomous trading systems developed with ecosystem partners.

**Security language model.** GoPlus plans to drive adversarial validation with its own security-specialized language model, trained on the network's accumulated security data and red-team attack traces. The model will generate attack paths, run red-versus-blue exercises against agent environments, and evaluate whether defenses hold. Because the same model also powers detection across DeepScan, SafuSkill, and GoPlus Intelligence, findings from the offensive side train the defensive side directly. This is where AI for Security and Security for AI meet.

## Architecture Principles

* **Local-first.** Guards and data-plane inspection run where the agent or application runs. Source code, raw prompts, and secrets can stay inside the customer's environment, and guards keep working offline.
* **Evidence minimization.** The platform records references, findings, and decisions rather than raw credentials or customer data.
* **Audited end-to-end.** Scope changes, policy publication, validation runs, approvals, and exports each produce a traceable event, and every decision records the policy version that made it.
* **Deny-first for consequential actions.** High-consequence agent actions and active validation do not proceed unless authorization, isolation, rate limits, and emergency-stop conditions are satisfied.
* **Control plane separated from data plane.** Organizations, identities, policies, and dashboards are managed centrally, while runtime inspection and enforcement can run in the cloud, a dedicated tenant, or the customer's own VPC or on-premise environment.

## AI Security and $GPS

AI Security decisions are security services consumed from the GoPlus Security Network. GoPlus intends for $GPS to be the settlement unit for that consumption:

* **Metered agent security:** gateway information-flow decisions, runtime action evaluations, deep scans, daily patrols, and adversarial scenarios are metered. Individual, team, and enterprise plans are priced in security-service units that settle in $GPS.
* **Supported payment models:** teams and enterprises may pay in fiat or stablecoins. GoPlus intends to route a defined share of that revenue into $GPS-denominated settlement on the network side.
* **Agent-originated consumption:** when GoPlus protects agents that also consume GoPlus Intelligence through the AI Agent Security API, both the runtime decision and the underlying intelligence call are part of the same $GPS-settled service economy.
* **Supply side:** the detectors, advisories, and threat intelligence that AI Security relies on are produced by data contributors and Security Compute Layer operators who stake and earn $GPS. Verified attack findings submitted to the Security Data Layer are rewarded in $GPS.

This is what allows $GPS utility to scale with security-service consumption rather than relying solely on secondary-market activity.

## AI Security in the GoPlus Security Layer

GoPlus AI Security is the agent access, action, and validation layer of GoPlus. It complements the rest of the ecosystem:

* **SafuSkill** secures the software supply chain through which agent skills and code are distributed, before they reach the protected environment.
* **GoPlus Intelligence** provides risk models, detection capabilities, and threat intelligence, including Web3-native coverage of wallet, contract, and signing risk, and exposes them to agents through the AI Agent Security API.
* **DeepScan** continuously assesses the smart contracts and applications agents may interact with.
* **GoPlus Security Network** enables open security data, distributed security compute, and verifiable security signals.
* **GoPlus Web3 Security** protects transactions, signatures, approvals, tokens, dApps, wallets, RPCs, and chains.

AI agents will increasingly operate Web3 wallets, manage on-chain assets, interact with dApps, deploy contracts, analyze tokens, and execute transactions. GoPlus AI Security protects access and action before they reach Web3, while GoPlus Web3 Security protects the on-chain execution path itself.

## Use Cases

**Developers using coding agents:** protect shell commands, file access, dependency installation, repository changes, deployment scripts, and credentials during agent-assisted development with the free local-first guard.

**Platform and security teams:** provide one governed gateway for every model the organization uses, apply organization-level policy to agent actions, route sensitive operations through approvals, and keep audit records of agent decisions.

**Enterprises in regulated industries:** enforce which models, regions, and providers may process which classes of data, with every decision logged and mapped to compliance requirements.

**AI agent platforms:** integrate runtime security and action evaluation into agent frameworks, tool routers, MCP workflows, and cloud agent infrastructure, with security consumption settled in $GPS.

**Security teams and researchers:** red-team agent deployments in an authorized, controlled environment, evaluate tools against open benchmarks, and earn $GPS for verified attack findings.

**Web3 and trading agents:** protect agents that interact with wallets, contracts, dApps, tokens, transaction builders, and cross-chain workflows, and validate trading agents against adversarial conditions before they handle real assets.

## Conclusion

GoPlus AI Security makes the AI security boundary visible. The gateway manages access, runtime protection governs action, and adversarial validation proves the boundary holds. Together they give enterprises control over how AI is used and what agents can do, create an auditable foundation for safe AI automation, and turn each security decision into a metered service settled in $GPS.