The Composition section makes a specific enforcement claim:
They compose perfectly: Agentveil enforces that any network egress containing local file data must first pass through prompt-scrub.
A network layer gateway cannot see inside an outbound request unless it terminates the TLS connection. Agent traffic is HTTPS to an inference endpoint or an API, so "egress containing local file data" is not observable from the network layer. To enforce this as written, Agentveil would have to run as a MITM proxy with a locally trusted CA, intercepting the agent's own inference calls. That is a large design decision with real consequences (certificate installation, a component that can read every prompt the user sends, an interaction with certificate pinning) and it appears nowhere else in the document.
There is also a scope collision. If Agentveil is inspecting request bodies for local file content, it is doing content inspection, which is the thing the paper says it does not do.
The version that works is at the tool boundary rather than the network layer: the agent calls prompt-scrub on outbound payloads, and Agentveil's contribution is the policy saying it must (and the audit record proving it did), not the interception that catches it if it does not. That is a weaker claim than "enforces", but it is honest and it still composes.
Worth noting the split as the document already frames it is genuinely good and does not need overstating:
While prompt-scrub protects data leaving the machine in the prompt, Agentveil protects the machine from the agent's actions.
That sentence is the useful part. The enforcement claim after it is what needs adjusting.
Two smaller notes on the same section:
- NanoOS is cited as a future consumer. Its whitepaper is currently
Paused, so it is worth saying so rather than presenting it as a pipeline that exists.
- Sentinel is a first mention and the brand guidance asks that pre-1.0 mentions be paired with "alpha".
What would help: restate the prompt-scrub line as a policy obligation with an audit record rather than gateway enforcement, or, if MITM inspection really is intended, add it to Proposed approach where it can be argued on its merits.
Raised during the public review window (closes 2026-09-19).
The Composition section makes a specific enforcement claim:
A network layer gateway cannot see inside an outbound request unless it terminates the TLS connection. Agent traffic is HTTPS to an inference endpoint or an API, so "egress containing local file data" is not observable from the network layer. To enforce this as written, Agentveil would have to run as a MITM proxy with a locally trusted CA, intercepting the agent's own inference calls. That is a large design decision with real consequences (certificate installation, a component that can read every prompt the user sends, an interaction with certificate pinning) and it appears nowhere else in the document.
There is also a scope collision. If Agentveil is inspecting request bodies for local file content, it is doing content inspection, which is the thing the paper says it does not do.
The version that works is at the tool boundary rather than the network layer: the agent calls
prompt-scrubon outbound payloads, and Agentveil's contribution is the policy saying it must (and the audit record proving it did), not the interception that catches it if it does not. That is a weaker claim than "enforces", but it is honest and it still composes.Worth noting the split as the document already frames it is genuinely good and does not need overstating:
That sentence is the useful part. The enforcement claim after it is what needs adjusting.
Two smaller notes on the same section:
Paused, so it is worth saying so rather than presenting it as a pipeline that exists.What would help: restate the
prompt-scrubline as a policy obligation with an audit record rather than gateway enforcement, or, if MITM inspection really is intended, add it to Proposed approach where it can be argued on its merits.Raised during the public review window (closes 2026-09-19).