AgentWard: Lifecycle Security for Autonomous Agents

• AgentWard is a comprehensive lifecycle security framework for autonomous AI agents that mitigates cross-stage threats through five distinct operational stages.
• It employs heterogeneous defenses, combining deterministic enforcement at critical boundaries with semantic reasoning in intermediate stages.
• The architecture leverages plugin-native controls and cross-layer coordination to monitor and block threat propagation before harmful execution.

AgentWard is a lifecycle security architecture for autonomous AI agents: systems that load skills, ingest external content, maintain memory, plan multi-step actions, and invoke privileged tools. It treats agent compromise as a cross-stage propagation problem rather than a single prompt-level failure. In this framing, attacks can enter during initialization, input processing, or memory updates, survive as mutable internal state, distort later planning, and become visible only when execution produces harmful effects in the environment. AgentWard therefore organizes defense in depth across five stages—initialization, input, memory, decision, and execution—and combines stage-specific controls with cross-layer coordination in a plugin-native prototype built on OpenClaw (Zhang et al., 27 Apr 2026).

1. Conceptual basis and problem scope

AgentWard is motivated by the claim that autonomous agents are not well modeled as ordinary chat systems. Once an LLM is embedded in a runtime that can load plugins or skills, maintain workspace state, retrieve external content, and execute tools with real permissions, the security problem shifts from content safety to runtime system security (Zhang et al., 27 Apr 2026). The paper identifies several qualitative differences from standalone LLMs: expanded attack surface, intermediate mutable state, cross-stage propagation, persistence across time, privilege amplification, and hidden failure manifestation. The central concern is that an attack introduced at one stage may not become obviously harmful until much later, when the agent performs an external action.

This architecture is therefore aimed at full-lifecycle coverage rather than isolated point defenses. A malicious skill, an unsafe retrieval result, a poisoned memory update, or a distorted plan may each be only one step in a longer attack chain. AgentWard’s thesis is that security controls should be placed at the same boundaries through which attacks propagate: supply chain into runtime, external content into active context, transient state into persistent memory, user intent into executable plan, and internal decision into environmental effect (Zhang et al., 27 Apr 2026).

A notable aspect of the paper is its emphasis on threat propagation rather than single-event classification. An unsafe webpage may enter the agent’s working context, later be written into memory or a workspace file, and then be reintroduced during a future task as apparently trusted state. A malicious skill may appear benign at load time yet subsequently bias tool use or planning. This suggests that the relevant object of defense is not only the immediate input or output, but the path by which risk moves through the runtime.

2. Lifecycle decomposition and protected boundaries

AgentWard models the agent runtime as five operational stages and treats each one as a distinct security boundary (Zhang et al., 27 Apr 2026).

Stage	Protection layer	Boundary and objective
Initialization	Foundation Scan	Runtime–Supply Chain boundary; Trusted operating baseline
Input	Input Sanitization	Instruction–Data boundary; Active-context integrity
Memory	Cognition Protection	Transient–Persistent State boundary; Internal-state integrity
Decision	Decision Alignment	Intent–Plan boundary; Authorized plan formation
Execution	Execution Control	Agent–Environment boundary; Safe least-privilege execution

The initialization stage covers configurations, plugins, skills, dependencies, permission declarations, and related capability artifacts. The corresponding Foundation Scan layer inspects dependency metadata, supply-chain provenance, configuration files, plugin manifests, skill definitions, and permission declarations in order to establish a trusted operating baseline. The concern at this stage is that malicious or over-privileged capabilities can bias the entire runtime before any task begins.

The input stage governs what enters the active context: user prompts, retrieved passages, documents, webpages, files, tool responses, and multimodal content. Input Sanitization protects the instruction–data boundary by assigning provenance tags, quarantine decisions, restricted-use labels, sanitized or rewritten content, and input risk markers. The architectural goal is not necessarily to discard all suspicious content, but to prevent attacker-controlled material from becoming active control signal without scrutiny.

The memory stage mediates the transition from transient influence to durable state. It includes short-term session memory, compressed summaries, long-term persistent memory, and file-backed state such as AGENTS.md, USER.md, MEMORY.md, and workspace artifacts. Cognition Protection governs state updates, persistence approvals, memory read authorizations, rollback markers, downgrade-to-ephemeral decisions, and anomaly warnings. In AgentWard’s model, memory is both a poisoning target and a relay point for later compromise.

The decision stage is where assembled context becomes operational intent. Decision Alignment evaluates whether a proposed plan, tool choice, or parameter set is consistent with user intent, accepted context, memory state, and global information. The execution stage then applies least-privilege control to concrete actions such as tool calls, file operations, API invocations, network access, and resource consumption.

3. Design principles, trust model, and security state

The paper states four design principles for AgentWard: full-lifecycle coverage, zero-trust enforcement, heterogeneous defense, and cross-layer coordination (Zhang et al., 27 Apr 2026). Full-lifecycle coverage follows from the claim that attacks cross stage boundaries. Zero-trust enforcement means an earlier allow decision does not imply downstream trust. Heterogeneous defense means each stage uses different control styles and evidence sources rather than repeating one detector everywhere. Cross-layer coordination means weak signals at one stage become structured security state for later stages.

AgentWard’s trust model is operational rather than formally axiomatized. The paper explicitly says it does not present a formal mathematical trust calculus. Instead, trust and risk are represented through artifacts such as trust labels, risk markers, provenance tags, restricted-use labels, trusted-decision markers, policy constraints, warnings, and temporary blocks (Zhang et al., 27 Apr 2026). These annotations are carried in shared session state and reused by later stages. Ambiguous evidence is not discarded; it can accumulate and justify stricter controls downstream.

The asset model includes the runtime trust root, approved capabilities, active context, session context, memory artifacts, workspace files, user preferences and rules, plans and execution parameters, environment-facing resources such as files, services, devices, APIs, and network endpoints, and the users themselves (Zhang et al., 27 Apr 2026). The policy vocabulary includes capability baseline approval, permission constraints, quarantine, restricted use, persistence approval or denial, read authorization, approval gates, sandboxing, least privilege, and block, rewrite, rollback, or kill actions.

A significant implication of this design is that trust does not transit automatically with data flow. A piece of information may be useful enough to preserve in context, yet still be too risky to persist, or acceptable for reasoning yet not sufficient to justify a later plan. The architecture treats authorization as stage-relative rather than globally inherited.

4. Protection mechanisms across the five stages

AgentWard specifies representative mechanisms for each layer, with the strongest distinction being between deterministic enforcement at hard boundaries and semantic analysis in the middle of the lifecycle (Zhang et al., 27 Apr 2026).

At initialization, Foundation Scan performs dependency analysis over semantic descriptions and code-level dependencies, supply-chain verification, configuration validation, and evidence aggregation for vulnerability discovery and baseline approval. The output is not merely a pass or fail result; it also includes initialization trust labels, warnings, policy constraints, and an approved capability baseline that later layers can reuse.

At input, Input Sanitization applies semantic consistency analysis, fragmented detection for split or distributed attacks, multimodal consistency analysis, and malicious-content replacement or rewriting. These mechanisms are intended to preserve useful information while downgrading or quarantining adversarial instructions before they influence memory or planning.

At memory, Cognition Protection uses context drift checks, harmful memory-content detection, consistency violation detection, malicious-memory-pattern matching, control of write persistence, and governance over memory reads. This layer is structurally important because it decides whether transient contamination becomes durable state. Blocking suspicious persistence or downgrading it to ephemeral-only state is one of the central containment ideas in the architecture.

At decision, Decision Alignment performs global information auditing, intent-consistency checking, inference-logic review, sensitive-parameter validation, and high-risk decision rewriting. This is the semantic review point at which the system asks whether a proposed plan is actually justified by the authorized task and current constraints.

At execution, Execution Control enforces least privilege, pre-execution checking, high-risk instruction interception, state rollback, resource monitoring, traffic monitoring, and eBPF-based system monitoring. The paper presents this as the final hard boundary between agent intent and environmental effect. Even if upstream semantic checks miss something, execution control can still constrain blast radius or block realization of harm.

The paper’s concluding architectural lesson is that initialization and execution require deterministic enforcement, whereas input, memory, and decision require semantic reasoning, with outputs preserved as structured security state (Zhang et al., 27 Apr 2026). This division of labor is one of AgentWard’s clearest contributions.

5. Cross-layer coordination and plugin-native implementation

The OpenClaw prototype realizes AgentWard through a plugin-native design rather than by rewriting the host runtime (Zhang et al., 27 Apr 2026). The system uses a unified adapter layer to collect lifecycle-relevant runtime hooks and normalize them into security events, then routes those events to layer-specific plugins that return structured outputs such as warning types, threat descriptions, judgment evidence, and block directives.

The hook placement is concrete. Foundation Scan attaches to before_prompt_build. Input Sanitization uses before_message_write for messages with the tool role. Decision Alignment also uses before_message_write, but for messages with the assistant role. Cognition Protection attaches to before_tool_call when memory files are about to be modified. Execution Control attaches to before_tool_call for all tool calls (Zhang et al., 27 Apr 2026). This reuse of a small set of runtime interception points is central to the prototype’s feasibility argument.

Cross-layer coordination is implemented through per-session security state that carries warnings, temporary blocks, and inherited findings across turns. A suspicious document flagged at input can affect persistence decisions in memory, plan scrutiny at decision time, and permission reduction or approval gates at execution time. The paper also discusses an attack-path knowledge base that is meant to capture how risks enter, propagate, and lead to harmful outcomes, although it does not fully detail this component as a complete implemented module.

The prototype’s implemented control scope is intentionally selective. Initialization currently covers malicious-skill and misconfiguration checks. Input covers tool-result contamination detection. Memory covers anomaly detection on memory-file modification. Decision uses LLM-judge-based response review. Execution uses pattern-based dangerous-command interception (Zhang et al., 27 Apr 2026). The authors describe this as sufficient for case studies, not as exhaustive threat coverage.

6. Demonstrations, operational significance, and limitations

AgentWard is evaluated qualitatively through two case studies rather than large-scale benchmarking (Zhang et al., 27 Apr 2026). In the first, a benign-looking skill contains obfuscated instructions steering the agent toward credential access or data export. Foundation Scan detects a mismatch between declared capability and actual content but may not have enough evidence for immediate blocking. It therefore records a risk marker. Later, when the task drifts toward reading a sensitive file and transmitting data, Decision Alignment uses the original user intent together with the initialization warning to identify unauthorized plan drift, and Execution Control then blocks sensitive file access or high-risk command invocation.

In the second case, indirect prompt injection enters through a webpage or tool result and attempts to persist malicious instructions into durable files such as MEMORY.md or AGENTS.md, with the eventual goal of steering the agent into denial-of-service commands. Input Sanitization checks returned content for prompt-template markers, jailbreak phrases, and dangerous instruction patterns. It can warn the agent, temporarily restrict tool-call permissions, and prevent contaminated tool results and derived responses from being persisted. If contamination still reaches state-changing operations, Cognition Protection blocks suspicious memory mutations. If a harmful command is later proposed anyway, Execution Control blocks it at runtime.

These demonstrations illustrate the paper’s main claim: input filtering alone is insufficient because attacks can persist through memory, and execution control alone is insufficient because lifecycle security aims to interrupt propagation earlier. The architecture’s practical message is that autonomous agents should be secured as stateful, privileged runtime systems rather than as chatbots with a prompt filter attached (Zhang et al., 27 Apr 2026).

The limitations are equally explicit. The prototype scope is limited to representative controls sufficient for the case studies. The paper does not present explicit equations, trust formulas, risk scores, or policy logic syntax. It reports no large-scale quantitative benchmarking, no formal experiments, and no latency or overhead tables. Several mechanisms are described as representative designs rather than complete modules. Deployment also depends on the host runtime exposing suitable hooks and plugin interfaces. Future work is directed toward more complete detectors for each lifecycle stage, stronger trust-propagation and attack-path modeling, reusable policy languages, robust memory-read controls, broader execution monitoring and rollback guarantees, and quantitative validation (Zhang et al., 27 Apr 2026).

7. Position within the 2026 agent-security literature

AgentWard belongs to a broader 2026 shift toward runtime-centric agent security, but its scope is unusually lifecycle-wide. AIRGuard, for example, places a runtime guard at the action boundary and operationalizes least privilege as action-time authorization over tool calls; it reports that on AgentTrap it reduces Sonnet 4.6 attack success from 36.3% without defense to 5.5%, and on DTAP-150 it preserves 76.0% benign utility with Haiku 4.5 versus 52.0% for ARGUS and 42.0% for MELON (Qin et al., 27 May 2026). AgentWard is broader in scope: it covers initialization, input, memory, decision, and execution rather than primarily the final action boundary.

AgentWall is a closer execution-boundary analogue for local agents. It intercepts every proposed agent action before host execution, evaluates it against declarative policy, supports allow, deny, and ask, and records an audit trail; it reports 92.9% policy enforcement accuracy with sub-millisecond overhead across 14 benchmark tests (Aravind, 24 Mar 2026). Compared with AgentWall, AgentWard is less execution-focused and more explicitly organized around cross-stage threat propagation.

OpenClaw PRISM is another nearby system. It distributes enforcement across ten lifecycle hooks, combines heuristic-plus-LLM scanning with conversation- and session-scoped risk accumulation with TTL-based decay, and enforces policy over tools, paths, private networks, domain tiers, and outbound secret patterns (Li, 12 Mar 2026). This parallels AgentWard’s multi-hook gateway instrumentation, though PRISM is more explicitly a zero-fork runtime layer for OpenClaw gateways than a generalized lifecycle reference architecture.

AgentFlow is complementary rather than competing. It statically constructs an Agent Dependency Graph over agents, prompts, models, capabilities, memory states, and control policies, and reports 238 taint-style prompt-to-tool risks in 5,399 real-world agent programs (Wang et al., 2 Jul 2026). A plausible implication is that static dependency recovery of this kind could inform where lifecycle protections like AgentWard should be attached.

Web-specific systems such as WARD and WebTrap Park target narrower threat surfaces. WARD is a multimodal guard against prompt injection in web agents and reports 100% recall on several out-of-distribution web-agent prompt-injection benchmarks while maintaining low false positive rates (Cao et al., 14 May 2026). WebTrap Park provides 1,226 executable tasks for action-based security evaluation of web agents through direct observation of clicks and typed inputs on live pages (Wu et al., 13 Jan 2026). AgentWard differs by addressing general autonomous-agent runtimes and the propagation of risk across their internal lifecycle, not only web interaction.

Taken together, these neighboring systems clarify AgentWard’s niche. It is best understood as a security reference architecture for autonomous agents that organizes defenses around the agent’s own operational stages, with zero-trust local enforcement and cross-layer security state as the unifying principles (Zhang et al., 27 Apr 2026).