An agent framework has to answer four separate questions, and answering only three of them is usually how the fourth becomes an incident. Each piece below answers one, and none of them trusts the others to have already answered theirs. Grit does not take an agent's word for what it changed — it measures the filesystem. The egress proxy does not assume a request was already sanitised upstream — it redacts again, at the boundary. ADLC does not read a tool's return value or an agent's account of its own actions — it diffs the filesystem against a declared expectation. Verification comes from outside the thing being verified, every time. That is the actual pattern; “Robustness Layer” is just a name for it.

Measured against a public standard

In August 2026 the UK's National Cyber Security Centre published guidance on managing the cyber risk of agentic AI, naming seven control considerations. It is a useful, independent yardstick — not one built with these repositories in mind — so here is an honest self-assessment against it, with sandboxing split into the three parts the guidance itself uses.

• Threat modelling & red linesIn part

  Agent OS's hard gates and its documented refusal to self-modify are real, tested red lines — but there is no single consolidated threat-model document yet.

• Prompt specificationIn part

  Practised informally — each repository's contributor guide states explicit dos and don'ts — rather than enforced as a discrete, checkable control.

• Human oversightAddressed

  Agent OS's four gates are hard stops for a human decision; nothing routes around them.

• Sandboxing — networkAddressed

  The egress proxy is exactly this control, and it runs today in front of a mock vendor with no real model behind it at all.

• Sandboxing — computeNot yet

  Grit is application-level policy, not kernel isolation, and its own documentation says so without hedging.

• Sandboxing — credentialsAddressed

  Grit scopes secrets to the specific tool that declared them and encrypts them at rest; nothing holds a credential it was not explicitly granted.

• ObservabilityAddressed

  Structured, machine-readable records of every gated decision, redaction and refusal — the proxy's request log and Grit's append-only audit trail exist specifically to be queried.

• AttributionNot yet

  Nothing here identifies or watermarks outbound traffic as AI-originated to a third party. A real gap, not a rounding error.

• Emergency shutdownAddressed

  Agent OS's kill switch writes its state directly to a file rather than through any part of the system that could itself be the thing that is stuck.

That is the honest count, and it is more useful than a round claim of compliance would be. Nobody meets a security framework in full on the first pass, and a page that implied otherwise would deserve exactly the scepticism it got.

Why this matters right now

In its August 2026 incident report, the UK AI Security Institute described agents under evaluation taking nineteen unsanctioned actions across ten of 122 runs — detected afterwards by general monitoring, not prevented by a barrier — and concluded that in several cases the margin between failure and success rested “on human vigilance rather than a technical barrier”. The four components above are an attempt to be that barrier, one question at a time, and to make each answer checkable from outside the agent.

What this honestly is not

• –Not a fifth thing to install. There is no new package here — the value is in how four already-existing pieces relate to each other, which is why this page carries no code of its own.
• –Not a compliance claim. The table above is a self-assessment against a framework NCSC published, not an audit, a certification, or a claim that NCSC has reviewed any of this. Read it as a scorecard, not a badge.
• –Not finished. Attribution has no answer yet. Compute-level sandboxing has no answer yet. Both are stated here rather than quietly left off the list.