Overview

This chapter extends confidential computing from a single inference request to an agent that retains memory, holds credentials, invokes tools, and delegates. It maps perception, planning, memory, action, and coordination, then separates infrastructure protection from semantic safety: TEEs can shield selected runtime state from privileged hosts, but not automatically secure vector stores, tool authority, peer behavior, provenance, or freshness.

Learning outcomes

An agent’s prompts, memory, credentials, tools, and peer messages create distinct assets and boundaries beyond a stateless inference request.
TEE isolation is strongest against privileged infrastructure access; timing channels, residual state, malicious content, and unsafe authority remain separate concerns.
Attested identities and authenticated messages do not prove truthful behavior or preserved user intent; delegation needs scope, provenance, and freshness controls.

Keywords

Confidential computingAgentsMemoryToolsDelegationProvenance

When the Model Can Act: Confidential Computing for AI Agents

This chapter applies the runtime boundary to an AI agent rather than a single inference request. The focus is what changes when the model can plan over several steps, retain memory, hold credentials, invoke tools, and delegate work. Readers should be able to locate the five layers of an agentic system, see which assets and decisions cross each layer, and explain why keeping the runtime secret from a cloud operator does not by itself make the agent’s instructions safe.

The distinction matters because an agent is not only a model that answers. It is a long-lived control loop. It gathers context, reasons over that context, changes or retrieves state, and produces actions that can affect external systems. Confidential computing can reduce the chance that privileged infrastructure software reads the agent’s prompts, weights, credentials, or memory. It cannot decide whether a document is manipulating the agent or whether an authorized tool call expresses the user’s real intent.

An agent accumulates state and authority

A stateless inference service receives an input, computes a response, and may finish without retaining much context. An agent may carry a conversation across sessions, consult a long-term vector store, keep a record of previous actions, and invoke a database, web service, code runner, or other API. It can also communicate with peer agents that no single organization fully controls. Each extra step creates another place where sensitive state can be copied, changed, replayed, or interpreted.

The first layer is perception. This is where the agent ingests user messages, retrieved documents, tool responses, and inter-agent messages. Those inputs enter the context that will influence the model. A document can therefore be more than passive data. It can contain language that attempts to redirect what the agent does next.

The second is planning and reasoning. The model processes accumulated context and proposes a sequence of tool calls, generated tasks, or delegations. This is the agent’s cognitive core, but it is also a control surface. In a traditional service, authorization is usually expressed through typed interfaces and explicit credentials. In an agent, the effective instruction can be distributed across the system prompt, user request, retrieved content, and previous messages.

The third is memory. Agent state may include the active context window, a key-value cache used during inference, long-term vector stores, episodic conversation history, model weights, and fine-tuned adapters. Some of this state is transient; some survives for months. A memory boundary therefore has to answer more than “can the host read this request?” It has to answer who can read old context, how a result is associated with its source, and whether state has been contaminated by another user or agent.

The fourth is action and tool execution. This is where the model’s output becomes an operation against the outside world. The agent may use credentials to search, write a record, run code, or call a business API. A tool call can be confidential in transit and still be dangerous if its parameters were changed, its recipient was impersonated, or the agent’s credential grants more authority than the user intended.

The fifth is coordination. Multiple agents may exchange messages and delegate subtasks through protocols such as MCP or A2A.

Published by DeepMox

FAQ

What makes an AI agent different from a stateless inference service?

An AI agent retains or retrieves context, reasons across steps, and can use credentials to invoke tools or delegate work, creating more persistent state and authority.

Which parts of an AI agent can a TEE protect?

A TEE can protect selected prompts, model state, credentials, memory, and execution layers only when their code, state, and paths are actually inside the attested boundary. It does not automatically cover external stores, tools, or peers.

Can attestation make an AI agent’s tool calls safe?

No. Attestation can help prove expected runtime or tool software, but separate policy must check whether the action, parameters, identity, recipient, and user intent are authorized.

Previous10 minConfidential Computing: AI Security in HPC

Next11 minConfidential Computing Platforms for AI