Compounding intelligence with Ontology + Knowledge Graph + Handles
Capability-secure resources for the agent era.
With a patent pending, we’ve invented the definitive architecture to safely enable agents at scale. Replacing probabilistic guardrails with formal ontology and capability-secure ‘handles.’
View the Handles presentation
Authority failures after authentication.
Most agent security failures are not authentication failures; they are authority failures after authentication.
"Agents often have broad credentials, while policy enforcement is ‘layered on top’ and can be bypassed through prompt injection, tool chaining, or compromised dependencies."
That makes the real challenge: How do we ensure agents only use the authority they were explicitly intended to use, and only in the ways intended?
The agent identity challenge.
Access Overreach
Of organizations using AI agents suspect those agents have accessed data beyond their intended scope. 61% have rotated credentials due to suspected exposure.
Slow Containment
Average time required to detect a compromised AI agent, followed by nearly a full week to contain and remediate security exposure.
Lack of Control
Of AI-related breaches occurred where proper access controls were missing. Shadow AI adds an average of $670,000 to total breach costs.
What if the object itself is the security boundary?
The Handle = Capability
The Handle's metadata declares exactly what it can do and there is no hidden credential with broader access.
When an AI agent receives a Handle, it receives exactly what it is allowed to do; nothing more exists on the object. This is the difference between checking if an agent is allowed, and making unauthorized actions physically impossible.
Structural versus probabilistic security
Security depends on the policy layer correctly intercepting actions at runtime; any missed enforcement point can create an exploitable gap. The risk is not just breach, but silent policy drift across tools, prompts, and workflows.
The Handle can only do what its DataSource allows, even if a prompt injection succeeds and compromises the agent entirely, the damage is strictly bounded by the object itself, not a central policy runtime.
Deontic reasoning (obligations, permissions, prohibitions) is mathematically enforced when any Handle is invoked.
The four pillars of structural security
Knowledge Source
Incremental Ontology that is inspectable, growing, and formally verified.
Output Control
Typed Knowledge Graph Entities designed with structural constraints.
Tool Discovery
Semantic search optimized over rich, self-describing metadata structures.
Security Model
Handles - where the object/resource itself acts as the definitive security boundary.
The key primitive: Structural attenuation
A child handle can only possess capabilities that represent a subset or equality of the parent's boundaries, making authority escalation mathematically impossible.
The Mechanism
The handle.query() method creates an entirely new, independent Handle with a narrower scope. Crucially, the child Handle has absolutely no reference to the parent Handle.
Monotonically Narrowing
A child can only do equal or less than its parent, never more. This strips away the traditional "wrapper" approach and creates a genuinely less powerful, isolated object.
Self-description and AI native discovery.
Instantly usable by any agent.
Agents no longer need bespoke, hard-coded tool definitions. Every Handle dynamically declares exactly what it is, what methods it has, and what its current schema allows.
Handles are not just a nicer API for resources; they represent the first practical implementation of capability-secure resource access natively designed for AI systems.
Incremental ontology.
The LLM is no longer the ‘brain’, the Knowledge Graph is.
A strict hierarchical classification of every system concept, including entities, operational processes, and directives.
The fundamental organising principle of our safety module. Knowledge strictly inherits execution constraints downward.
Agents naturally reason about boundaries because the ontological hierarchy itself represents the runtime prototype chain.
The synchronous contract.
Ergonomic security requires a flawless developer experience. Handles wrap asynchronous infrastructure realities (such as APIs, networks, and remote databases) in a synchronous, intuitive execution shell.
Race Condition Elimination
No race conditions occur during dynamic subscription setup or runtime handler registration.
Composable Chaining
Seamless and fully composable method chaining occurs without callback tangles or nested closures.
Introspection Preservation
System identity, schema types, and detailed metadata introspection are fully preserved at every logical layer of the chain.
Built-in network transparency.
A remote handle looks, introspects, and behaves identically to a local inline Handle.
Capabilities cross complex network boundaries transparently, maintaining their strictly attenuated scope through capability-aware serialization frameworks. The underlying transport mechanism is fully pluggable.
The ccosystem flywheel:
Write once, secure everywhere.
Wrap
Developer wraps an external API or relational database structure in a clean, basic Handle.
Discover
The Handle’s rich, self-describing metadata structures make it instantly discoverable for LLM agents.
Secure
Built-in structural attenuation makes the deployed Handle immediately safe to utilise at enterprise scale.
Scale
The wrapped capability works natively across all language and framework system bindings.
Handles solve the universal interface problem. Because runtime control is simple and the mathematical security payoff is immediate, the ecosystem architecture naturally builds itself.
One package unlocks seamless and secure AI integration.
Beyond the sandbox:
Enterprise architectures at scale
AI Sandboxing
An LLM node accessing core customer data through a highly constricted Handle, providing structural guarantees against unauthorized modification or runtime escape.
Multi-tenant SaaS
Distinct tenant contexts holding separate Handles. Mathematical structural isolation proves that tenant profiles literally cannot access other database partitions.
IoT & Edge
Physical edge nodes dynamically receiving attenuated capability blocks based on geometric coordinates and real-time environment status.
We propose the definitive protocol for the agent era.
Object-capability security is a 60-year-old architectural paradigm for building secure software and access-control systems. We believe it required the unique operational challenges of the AI Agent era to make its implementation a structural necessity. Handles make it practical for enterprise developers.
2026 | All rights reserved.