OpenShell described how it uses Z3, a solver for logical constraints, to formally check permission changes proposed by AI agents. The check determines whether a proposed policy can allow an action that the reference policy does not allow.
For a network action, the OpenShell prover models the executable, host, port, network layer, HTTP method, and path.
Before approving each proposed policy, OpenShell runs four built-in expert security checks.
Claim check:
- OpenShell described using Z3 to formally check whether an AI agent’s proposed policy change stays within previously approved permissions. (confirmed by the publication itself: evidence; «In this post- we’ll dive into how permission review breaks at agent scale, and how to use the Z3 open source library to write a formal proof that a policy change proposed by an agent stays inside what you approved.»)
- The check determines whether a proposed policy can allow an action that the reference policy does not allow. (confirmed by the publication itself: evidence; «asks if a proposed policy can do any actions that a expert pre-defined policy (for example, Github read-only) cannot do.»)
- For a network action, the OpenShell prover models the executable, host, port, network layer, HTTP method, and path. (confirmed by the publication itself: evidence; «OpenShell’s runtime prover models the following attributes for any network action: action = { binary: String, host: String, port: Int, layer: String, method: String, path: String }»)
- Before approving each proposed policy, OpenShell runs four built-in expert security checks. (confirmed by the publication itself: evidence; «Today, the OpenShell policy prover encodes the following expert queries which run on every proposed policy before approval.»)
Primary sources:
score 65.3 out of 100 · kind: guide