Identify the actor
A name helps locate a session. Its current binding and permission to act are separate questions that need their own checks.
Security and trust
Make the boundary clear.
Make the evidence useful.
When people and agents work across tools, trust depends on knowing what was observed, who can act, and what has actually been verified. Aevos is being built around those distinctions.
The approach
Security is a system property.
These are design principles and developing capabilities, not a claim of universal enforcement or completed compliance.
Scope the action
Permissions and leases can bound a particular action. What is allowed depends on the relevant policy and the enforcement available on that path.
Inspect the record
Events and receipts can record what was reported. Their contents, source, and supporting evidence still need to be examined.
Distinguish each step
A delivered request is not necessarily acknowledged, executed, verified, or settled. Each step needs its own evidence.
Use layers together
Access controls, isolation, monitoring, and review address different risks. An activity record is not a substitute for prevention or containment.
Show what is unknown
A stale, partial, or unavailable view is not proof of the underlying state. The surface should make those limits clear.
Explore the platform
Follow the work and its evidence.
See how a request reached an existing agent session, and what that demonstration does—and does not—establish.