Autonomous Agents Need Mandatory Access Control
Comments on “Autonomous Agents Need Mandatory Access Control”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Legiscope proposes Agent Mandatory Access Control (AMAC), a draft profile in which an API accepts a deny-by-default policy with each agent task, returns the effective restrictions before execution, and refuses the run if any required enforcement point is missing. It draws on FreeBSD's MAC, Capsicum and jails, and on OWASP's Agent Control Standard. The author says OpenAI and Claude documentation already covers hosted network limits and permission policies, but application-executed tools remain the developer's job. AMAC is not an adopted standard, and Claude Managed Agents is documented as beta.
Why it ranked
No. 17 of 137 with a score of 0.70. The panel rated it highest on technical depth (0.85) and reader interest (0.80), lowest on substantiated (0.49). Placed No. 17, No. 12 by score alone: the fifth AI & machine learning story of the day (−0.040), and close to “Ring-0 by Default: Agents as Operating Systems”, No. 8 on Wednesday 28 October 2026 (−0.004). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Substantive, on-topic proposal on mandatory access control for AI agents with concrete technical detail and a sample policy; it is a proposal rather than evidence, so substantiation is moderate and it is not a tested result.
- AI judgeJudge 3gpt-5.6-luna
- A technically detailed proposal for mandatory access control across autonomous-agent execution, tools, networks, credentials, delegation, outputs, limits and revocation. It is actionable and novel, though not an implemented standard or independently validated system.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.70total under rubric v2.3
- Significance0.62
- Reader interest0.80
- Audience breadth0.72
- Practical relevance0.79
- Substantiated0.49
- Technical depth0.85
- New information0.78
- Counts against: Promotional0.05
- Counts against: Overclaim0.19
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.68 | 0.45 | 0.72 | 0.62 | 0.27 | +0.24 | +0.148 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.81 | 0.72 | 0.86 | 0.80 | 0.14 | +0.26 | +0.207 |
| Audience breadthHow many people who build technology does it concern? | 0.73 | 0.70 | 0.73 | 0.72 | 0.03 | +0.13 | +0.094 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.84 | 0.70 | 0.83 | 0.79 | 0.14 | +0.22 | +0.174 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.44 | 0.40 | 0.64 | 0.49 | 0.24 | +0.05 | +0.025 |
| Technical depthHow technically substantive is it? | 0.94 | 0.72 | 0.88 | 0.85 | 0.22 | +0.05 | +0.042 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.88 | 0.55 | 0.92 | 0.78 | 0.37 | +0.05 | +0.039 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.08 | 0.03 | 0.05 | 0.05 | −0.19 | −0.010 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.20 | 0.30 | 0.08 | 0.19 | 0.22 | −0.11 | −0.021 |
| Sum of contributions | +0.697 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.697 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-04/17/"><img src="https://rubric.hrih.si/badge/2026-11-04/17.svg" alt="Ranked #17 on Rubric, 4 Nov 2026" width="238" height="28"></a>Claim check
Claim check: 7 matches source · 1 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceNumber
Claude Managed Agents session budgets pause new model requests at a shared list-cost threshold, while requests already in flight and their tool calls may continue.
The cited source says the same thing.
The article says “Its session budgets pause new model requests at a shared list-cost threshold; requests already in flight and their tool calls may continue”
The source says “The request in flight when the cap is crossed still completes, so the final list cost can land a fraction past the budget”
Source cited by the article: platform.claude.com/docs/en/managed-agents/budgets
No source givenVersion
Claude Managed Agents is documented as beta.
The article gives no link or citation for it.
The article says “Claude Managed Agents is documented as beta”
The source says No source to compare with.
Matches sourceQuote
Anthropic's Managed Agents security guide recommends limited networking, narrow tool sets and appropriate approvals.
The cited source says the same thing.
The article says “Anthropic’s Managed Agents security guide recommends limited networking, narrow tool sets and appropriate approvals”
The source says “Use limited networking and list only the hosts the agent needs in allowed_hosts”
Source cited by the article: platform.claude.com/docs/en/managed-agents/secure-deployment
Matches sourceGeneralization
Anthropic's Claude Managed Agents permission policies distinguish automatic execution, approval through the application and server evaluation.
The cited source says the same thing.
The article says “Its permission policies distinguish automatic execution, approval through the application and server evaluation”
The source says “Permission policies control whether server-executed tools (the pre-built agent toolset and MCP toolset) run automatically, wait for your approval, or have each call evaluated by the server”
Source cited by the article: platform.claude.com/docs/en/managed-agents/permission-policies
Matches sourceGeneralization
Anthropic's sandbox boundaries documentation explicitly leaves custom tools under application control.
The cited source says the same thing.
The article says “Its sandbox boundaries explicitly leave custom tools under application control”
The source says “Custom tools | Your application | Your code”
Source cited by the article: platform.claude.com/docs/en/managed-agents/secure-deployment-risks
Matches sourceGeneralization
OpenAI's API IP allowlist controls which source addresses can call OpenAI.
The cited source says the same thing.
The article says “Its API IP allowlist controls which source addresses can call OpenAI”
The source says “An IP allowlist lets you restrict OpenAI API requests to IP addresses or CIDR ranges that you trust”
Source cited by the article: developers.openai.com/api/docs/guides/ip-allowlist
Matches sourceGeneralization
In FreeBSD Capsicum, capability mode restricts access to global namespaces, is inherited by future children and cannot be cleared by the process.
The cited source says the same thing.
The article says “Capability mode restricts access to global namespaces, is inherited by future children and cannot be cleared by the process”
The source says “Once set, the flag is inherited by future children processes, and may not be cleared”
Source cited by the article: man.freebsd.org/cgi/man.cgi
Matches sourceVersion
FreeBSD's mac_bsdextended module provides a filesystem firewall configured through ugidfw.
The cited source says the same thing.
The article says “Its mac_bsdextended module provides a filesystem firewall, configured through ugidfw”
The source says “The mac_bsdextended(4) module enforces a file system firewall”
Source cited by the article: docs.freebsd.org/en/books/handbook/mac
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 4 pts, not on front page
Recorded for context only, checked 4 Nov 2026, 05:47 UTC. It played no part in the ranking.