DROS-6P: A Unified Deterministic Runtime Governance Architecture Closing the Six Fundamental Trust Boundaries of Enterprise AI Agents / DROS-6P:閉環企業級AI Agent 六大信任邊界之 確定性執行期治理架構

Abstract

As Autonomous AI Agents transition from conversational prototypes to enterprise-grade execution agents, current security architectures face a fundamental breakdown. Enterprise deployment demands unequivocal answers to six core trust questions: Principal (who does the agent represent?), Authorization (what is it allowed to do?), Tool/Action Bound (which API calls are safe?), Policy Gate (how are high-risk actions controlled?), Audit Log (how are actions traced immutably?), and Expiry/Revocation (how is authorization revoked instantly?). Existing enterprise solutions address at best one or two boundaries: IAM frameworks resolve identity but fail at granular tool execution; prompt guardrails handle basic content filtering but lack real-time authorization or cryptographic auditability; SIEM platforms store logs post-hoc without real-time interception capabilities. This paper introduces DROS-6P, a unified, deterministic runtime governance kernel designed to enforce all six fundamental trust boundaries within a single C-ABI and eBPF in-band execution layer. Furthermore, to extend governance across the emerging Agentic Web without vendor lock-in, DROS introduces an "Open Identity, Localized Governance" paradigm via an open agent passport SDK (libdros-id / RFC-010). Cryptographic identity credentials circulate freely across cross-domain boundaries, while execution authority remains deterministically bounded in-band by resource owners at runtime. Under evaluated hardware workloads (Intel Xeon E3-1275L/1265L v3, 16GB RAM), the DROS in-band kernel demonstrates an average decision latency of 26.1 μs (σ = 1.42 μs, p99 = 29.8 μs). Specifically, DROS-6P enforces: (1) Principal via 3-tier PKI-signed DROS Identity Tokens (DIT); (2) Authorization via Capability Bitmaps mapping roles to execution vectors; (3) Tool/Action Bound via in-band C-ABI interceptors; (4) Policy Gate via dynamic data redaction, Human-In-The-Loop (HITL) suspension, and ZKP-Lite zero-knowledge proofs; (5) Audit Log via tamper-evident SHA-256 Merkle Hash Chains; and (6) Expiry/Revocation via O(1) Read-Copy-Update (RCU) atomic pointer swaps providing instant HTTP 403 enforcement. Evaluated across 1,200 adversarial payloads and six industrial domain tracks, DROS-6P provides a practical, foundational security infrastructure for the global Agentic Web ecosystem. 隨著自主 AI Agent 從對話型原型跨越至企業級執行 Agent,現有的資安防禦體系面臨根本性的瓦解。企業級部署需要對六大核心信任問題給出確定性解答:Principal (Agent 代表誰?)、Authorization (允許執行什麼?)、Tool/Action Bound (哪些 API 呼叫是安全的?)、Policy Gate (高風險動作如何管控?)、Audit Log (動作如何不可篡改追溯?) 以及 Expiry/Revocation (授權如何秒級撤銷?)。現有企業處方至多僅能處理一至兩個邊界。 本文提出 DROS-6P,一種統合、確定性的執行期治理內核,旨在單一 C-ABI 與 eBPF 帶內執行層中,同時強制執行全部六大信任邊界。此外,為了在無廠商鎖定的前提下將治理延伸至新興的 Agentic Web,DROS 透過開放式 Agent 護照 SDK (libdros-id / RFC-010) 提出了「開放身份,在地治理 (Open Identity, Localized Governance)」範式。密碼學身份憑證在跨域邊界自由流通,而執行權限則在運行期由資源擁有者於帶內確定性地約束。 在實測硬體負載 (Intel Xeon E3-1275L/1265L v3, 16GB RAM) 下,DROS 帶內內核展現出平均 26.1 μs 的決策延遲 (σ = 1.42 μs, p99 = 29.8 μs)。透過 1,200 筆紅隊對抗 Payload 與六大產業賽道的評估,DROS-6P 為全網 Agentic Web 生態系提供了實用且不可或缺的基石安全基礎設施。