Agentic AI Reference Architecture

Safety & Security · Software component

Runtime Security Policy Enforcer

Software componentSafety & SecuritySafety, Security & Governancearc:RuntimeSecurityPolicyEnforcer

A runtime-integrated enforcement component that intercepts system calls, file accesses, process spawns and network operations inside a sandbox and blocks or escalates those violating policy.

Responsibility. Blocks dangerous operations of executing code at runtime regardless of application logic.

Also known as: Runtime policy layer, Runtime policy engine

deployed onescalates toguardsemits telemetry tois configured byExecution Sandbox: deployed onExecution SandboxSecurity Analyst: escalates toSecurity AnalystCode Execution Runner: guardsCode Execution RunnerSandbox Anomaly Detector: emits telemetry toSandbox Anomaly DetectorRuntime Security Policy: is configured byRuntime Security Policy
Direct neighbourhood (hover for relationship types)

Relationships

deployed on structural

is configured by structural

emits telemetry to dynamic

escalates to dynamic

guards control

Classification

Patterns
Runtime policy enforcementDefense in depth over containerization
Technologies
Open Policy Agent (OPA)
Risks mitigated
Malicious code that evaded input filteringFork bombsSensitive file reads (e.g., /etc/shadow)

Sources

  1. Ch9.3: T. Nguyen, "Sandboxing and Transparency Foundations," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 9.3. ISBN: 9798244538229.