1. Describe actual authority
Record whether the agent receives untrusted content, reads private data, reaches external destinations, executes code, persists memory, delegates identity, destroys state, moves value or repeats actions. Do not use intended purpose as a substitute for real permission.
2. Activate only complete paths
A path should declare every required capability. Untrusted input plus private data plus egress activates an exfiltration condition; code plus open network creates another bridge; autonomy plus destructive writes amplifies mistakes.
3. Separate declared from verified controls
A checked box documents only that a team says a control exists. It cannot prove isolation, authorization or runtime behavior. Observed severity should therefore remain unchanged when declared coverage reaches one hundred percent.
4. Prioritize convergence points
Egress allowlists, task data boundaries, sandboxes, scoped tokens and immediate confirmation can cover several active paths. Priority should reflect both severity and reuse instead of raw alert count.
5. Rebuild continuously
The model changes when a tool, persistent memory, OAuth flow, shared session or autonomous loop is added. Rebuild after each change and verify controls in the runtime, network, identity and storage layers.
Frequently asked questions
H/M Blindspot · hogarmas.net
Does a map with no active path prove safety?
No. It only means no rule in the current bounded library matched the selected capabilities.
Is the profile or Agent Scope report uploaded?
No. The browser processes it locally, and Atlas exports omit tool names and the source report.
Does declared coverage mean an attack is blocked?
No. It means every recommended control was selected. Implementation must be verified independently.