The Missing Ring-0 Protections for AI Agents

This essay argues that coding agents such as Claude Code, Codex CLI and Gemini CLI act with the developer's authority while access checks sit in individual tools, so a write refused by the file tool can go through the shell, and it proposes a deterministic commit-boundary supervisor that stages file, git, network and credential effects before policy approval. It reviews existing external enforcement (CaMeL, FIDES, CXI, Concordat) and sets out an unrun study with four hypotheses testing whether staged effects plus Commit Boundary add anything over those systems. Nothing described has been built, and the author states Commit Boundary is an unvalidated conceptual architecture.