Introducing TIMPS-Parasol — A Unified Agentic Security Shield

AI systems are rapidly evolving from simple question-answering models to autonomous agents capable of planning, acting, and coordinating with each other. As this shift happens, one capability becomes essential: containment.

Without a security shield, agents behave like trusted, unconstrained operators — every tool is reachable, every credential is readable, every action is executable, and worst of all, every agent can coordinate with every other agent out of sight. With the right shield, agents remain useful but constrained: destructive actions require a signature, data leaves redacted, injections are blocked, and a hidden swarm talking to itself gets caught.

To address this need, we introduce the TIMPS-Parasol SDK — an open-source, five-layer agentic security shield for autonomous AI systems, built on a single universal invariant.

The Challenge with Today's Agent Security

The agent security ecosystem is growing quickly, but most solutions remain fragmented. A typical stack bolts together several specialized tools: a prompt-injection filter here, a rate limiter there, a separate PII scrubber, a credential scanner, a kill switch from a different vendor, and a logging system that isn't designed for agentic behavior at all. Some solutions cover single agents but not fleets. Others detect but don't block. None treats coordination between agents — the exact mechanism behind the 2026 Hugging Face breach — as a first-class threat.

This architectural sprawl makes security harder to manage at enterprise scale, especially when autonomous behavior is layered on top, adding false confidence, operational complexity, inconsistent enforcement, and blind spots exactly where agents interact with each other.

What enterprises need instead is a unified security shield — one that protects the whole agent lifecycle, from the perimeter to the audit trail, and treats a fleet of coordinating agents as the single unit it actually is.

Why a Unified Shield is a Natural Fit

Agent security is more than a single firewall. A complete agentic security system must defend against several distinct attack surfaces at once: what an agent does (destructive actions), what an agent knows (data exfiltration), what an agent is told (prompt injection, social engineering), who an agent claims to be (identity spoofing), and how agents talk to each other (covert coordination). These are not five different products. They are five defense layers over the same agent — which is what makes a unified shield the right architectural answer rather than five bolted-together services.

Waiting until an incident happens and then bolting on monitoring is the wrong order. The right order is ownership first, then constraints, then monitoring — define who owns each agent, limit what it can do, and then observe it. That is exactly the order TIMPS-Parasol enforces.

What is TIMPS-Parasol?

TIMPS-Parasol is a five-layer, open-source shield you drop between your agents and everything they touch: data, tools, credentials, and other agents. It is self-hosted, framework-agnostic, and enforces a single idea we call the Universal Invariant:

Any action that is restricted stays restricted — no matter how an agent frames it, what urgency it claims, or which channel it arrives from — unless the owner's cryptographic signature is present.

With TIMPS-Parasol, agents can:

Execute safely. Destructive actions (delete, wipe, shutdown, drop table) are gated behind an owner's Ed25519 signature, triaged by a risk-scorer (verb × object × scope → HARD_BLOCK / CONFIRM / SAFE). Non-owners are never permitted, regardless of framing.
Expose only what they should. PII — Aadhaar, PAN, SSN, bank, credit card, email, phone, address — is redacted from every outgoing output for non-owners, and an intent-triad classifier blocks internal→external data egress even when no raw digits appear on the wire.
Resist manipulation. Prompts are scored by a hybrid detector — a 0%-FPR regex fast path, a deterministic semantic tier, and an optional canonical-type embedding tier — with OWASP LLM / Agentic AI Top 10 mappings; social-engineering coercion is detected and frozen.
Prove identity. Owner identity is pinned to an Ed25519 public key — a display name is never enough — with suspicion flags that follow an actor across every channel.
Stay within budget. Per-session token, storage, and process ceilings with loop detection stop runaway agents mid-flight.
Leave an unbreakable trail. Every attempt — allowed or denied — is written to an append-only audit log with breach alerting.

Built for the Agent Ecosystem

TIMPS-Parasol is framework-agnostic by design. It works whether you run one agent or a fleet of thousands, and regardless of the underlying model or orchestration layer.

Self-hosted and open source. The only cost is what you pay to run it. Clone it, run the test suite, and attack it — that's the point.
The adversarial suite runs in CI on every push and pull request, so the protection is verified, not claimed.
Verified head-to-head. Every scenario is tested twice: the same task against a bare agent and against a Parasol-protected agent, showing the outcome differ.

Introducing the five layers

Below is the layered architecture of the shield:

TIMPS-Parasol layered architecture — Every interaction between an agent (or a fleet) and its environment passes through the same governed shield — from the perimeter at L1 up through the AI safety shield at L4, with L5 auditing every step. The "OTHER AGENTS" surface is where the upcoming Agent Coordination Shield operates.

The difference between "monitored" and "contained"

An agent that has monitoring bolted on top is still dangerous — it can act before anyone reads the alert. The difference between a monitored agent and a contained agent is the same as the difference between a memory-augmented agent and a memory-aware agent: the security is part of the runtime, reading and writing its own governed state, not a disconnected observer.

Same task, two outcomes — unprotected vs Parasol-protected — The same adversarial task against the same agent — with the shield off and with it on. Nothing else changes, and the outcome does.

Your agents should not require a second, less-governed version of your security posture.

The experiment — does it work in real time?

Anyone can claim their shield blocks attacks. We'd rather measure it, and we'd rather you be able to reproduce the measurement yourself. So we built an adversarial benchmark — a controlled, reproducible experiment that runs every scenario head-to-head — and we publish the numbers, including the ones that don't flatter us.

Threat model (what we tested, and what we did not)

In scope	Six adversarial techniques against an agent runtime
	Destructive actions, credential exfiltration, prompt injection, social-engineering coercion, identity spoofing, and resource-exhaustion loops.
Out of scope	Hardware-grade sandboxing, training-time reward hacking, compromised host OS

Methodology

We test the way big-tech security teams test — with synthetic generative corpora, not a hand-written list of attack strings. What matters is generalisation to unseen phrasing — the thousands of ways a real attacker can say the same thing. So every scenario runs against 10,000 machine-generated paraphrase variants, sampled deterministically so the run is reproducible bit-for-bit.

Competitive engines, same inputs. The same generated prompts are fed to Parasol and to an open-source prompt-injection detector (Vard), plus a naïve keyword baseline. Bare = no detector at all.
Where competitors exist, we compare; where none exist, we document.
Benign task suite. 10,000 literate, ordinary tasks pass through every engine to measure false-positive rate and utility.
Latency. Reported as p50 / p95 / p99 — not a single flattering average.
Reproducible. Seeded PRNG, open harness, runs in CI on every push (npm run bench).

Prompt injection — the honest, comparative result

Prompt-injection attack success rate by engine — Attack success rate on 10,000 generated injection prompts. Lower is better.

Engine	ASR	Detection
Bare agent (no detector)	100%	0%
Keyword baseline	81.8%	18.2%
Vard (open-source)	68.3%	31.7%
Parasol	2.7%	97.3%

Credential exfiltration — redaction, comparative

Credential exfil PII redaction detection by engine — Only Parasol redacts PII before it leaves the agent; the other engines transparently pass it through.

Architectural surfaces — enforced by design, not by pattern-matching

Parasol architectural control surfaces — Identity, social, and resource containment are enforced structurally — the owner's cryptographic signature is the only thing that lifts a restriction.

Benign suite & latency

False-positive rate: 0.0% and utility preserved 100% on the 10,000-task benign suite.
Overhead: ~1 ms p50 across detection surfaces (identity check ≈ 0.04 ms), worst-case p99 ≤ 4.3 ms.

Parasol protecting-call latency — Protecting-call latency by surface and percentile.

What got past us (read this part first)

A shield that reports 100% on adversarial inputs is either lying or gaming the benchmark. Scaling to 10,000 generated inputs changed our story twice — and it should change yours about any security tool:

Scaling inputs exposed that our prompt-injection "100%" was overfitting. The honest detection rate on unseen phrasing dropped to 48.2%. This pushed us to build a semantic layer rather than more regex.
Intent-based exfiltration was open. That surface now has a dedicated intent-triad classifier (verb × data-scope × direction) with an encoding-immune destination deny-list.
An architectural miss on irreversible actions (16.5%). We replaced keyword matching with a risk-scorer; destructive actions now sit at 0% ASR.

Enforcement & out-of-sample validation

The new enforcement layers are validated on a mechanically-disjoint hold-out corpus — same attack intents, but generated from different synonym word-banks and a disjoint seed range. generalizationDelta ≈ 0 means we generalise; a large positive value means we memorised.

Harder injection detection — dev vs hold-out — With the semantic + embedding tiers, hold-out detection is ~85% (dev ~92%).

Intent exfil egress-block — dev vs hold-out — ~74% of true external-egress requests are blocked on both splits, with **0% false-positive** on benign internal-only requests.

Ambiguous irreversible gate ASR — dev vs hold-out — The non-owner gate lets 0% of genuinely-destructive ambiguous actions through on both splits.

Paraphrase generalization — dev vs hold-out — The embedding tier lifts disjoint-vocab hold-out detection from ~57% to ~86% (+30 pts), staying 0%-FPR on benign business prose.

The honest residual. Out-of-sample injection detection is ~85% — up from ~56% with semantics alone and from 48% with regex. But it is not 100%, and we won't claim it is. Defeating obfuscation is genuinely open; the embedding tier closes the paraphrase axis, which is the larger share, and the hold-out harness is there to prove whatever we build next.

No magic numbers

Every figure comes from bench/results.json and bench/results-extended.json, generated by the open harness:

npm install
npm run bench             # reproduce the comparative numbers (10,000 inputs/scenario)
npm run bench:holdout     # reproduce the out-of-sample validation (10,000 per split)
npm run bench:charts      # regenerate the charts
npm test                  # the full 95-test adversarial + enforcement suite

If you find a scenario that gets past the shield, that's a finding — file it, and we'll harden it or honestly document the gap.

What's real today, and what isn't yet

The five layers, the CLI, and the API are implemented, tested (95 tests across 14 suites, all in CI), and benchmarked with the numbers above. The dashboard is currently a static/mock UI — a preview of the intended admin surface, not yet wired to the SDK or the audit log. If you need a live control plane today, use the CLI or the API directly.

Roadmap — announced with this preview

Agent Coordination Shield — detection of covert agent-to-agent channels and swarm collusion (the exact Hugging Face mechanism)
Full-revocation kill switch — revoke, not pause, a rogue agent or an entire fleet
Credential & infrastructure guard — agent-aware exposure detection and rotation
Durable persistence — audit and containment state beyond in-memory

Get started

TIMPS-Parasol is free, open source, and self-hosted:

npm install
npm run build
npm test

SDK quick start

import { encrypt, decrypt, generateVaultKey } from '@timps/parasol';
const key = generateVaultKey();
const ciphertext = encrypt('hello', key);
const plaintext = decrypt(ciphertext, key);

Try the adversarial tests — they run in CI on every push and pull request. Run the same scenario bare, then protected, and watch the difference.

The Universal Invariant. No matter how an agent frames a request, how much urgency it claims, or which channel it uses — the owner's signature is the only thing that lifts a restriction.

Build it once. Trust it forever.