ContractWarden: Kernel-Enforced Damage Boundaries for AI Agents via Human-Authorized Contracts
ContractWarden is a Linux reference monitor for LLM agents that binds a human-approved per-asset contract to a task before execution, then uses eBPF LSM hooks to enforce file/network allow, deny, and no-egress policies while propagating no-egress state across processes and supported IPC/file objects. The interesting bit is that it treats the model’s policy as only a proposal and puts a deterministic kernel-enforced damage boundary underneath the agent, though the evidence is still fairly scoped: tests are predefined, coverage is limited to supported paths and object lifecycles, and the measured overhead can be substantial on physical hardware.
Abstract
Large language model agents can execute commands, create subprocesses, and directly access files and networks, allowing prompt injection or planning errors to become operating-system side effects. We present ContractWarden, a Linux reference monitor that enforces a human-authorized damage boundary without trusting the agent or its policy suggestions. A model may propose a tri-state asset contract - allow, deny, or no_egress - but a human makes the final choice. An execution gate binds the contract to a concrete task before untrusted code runs. An extended Berkeley Packet Filter (eBPF) Linux Security Modules (LSM) data plane then enforces file and network decisions and monotonically propagates no_egress through processes, regular files, pipes, FIFOs, and supported Unix-domain sockets. All 570 runs across 19 security tests satisfy predefined return-value and side-effect criteria. On three co-located file-I/O workloads, median overhead is 11.96-12.89% in a Linux 6.15 virtual machine and 35.79-61.54% on a Linux 6.15 physical platform, lower than the evaluated frozen ActPlane baseline. The results demonstrate deterministic kernel enforcement for declared assets, supported paths, and controlled object lifecycles.