Labyrinth Scout

What Scout is

Scout is a research project exploring how to govern AI agents at runtime without tying that governance to any one agent, assistant, or vendor. Instead of building a new sandbox from scratch, Scout extends NVIDIA OpenShell, an open-source (Apache 2.0) sandbox and gateway for AI agents that already works with several different agent harnesses out of the box.

Scout sits inside OpenShell's own decision path as a registered extension: whenever an agent tries to cross a boundary — create a sandbox, attach a tool, reach a network service, pick up a credential — Scout is one of the things that gets asked, and one of the things that remembers what was decided and why.

What it's for, and who it benefits

Most AI agent safety tooling is wired into one specific agent framework: swap the agent, lose the governance. Scout's layer sits underneath that choice, so a team isn't locked into a single agent vendor just to keep their controls and audit trail.

The practical benefit is twofold:

• Portability. The same governance and evidence layer should keep working even if the agent running inside it changes — because it's built on a substrate designed to support more than one agent, rather than hooks specific to one.
• A real answer to "why was this allowed?" Enforcement alone only tells you a boundary was blocked or allowed. Scout's job is to also keep a durable, queryable record of the decision and link it to what happened afterward — so an incident review can ask "which decision let this happen," not just "what happened."

How it works

In plain terms, the flow looks like this:

The sandboxing and enforcement itself — who's allowed to do what, signed policy, credential handling — is OpenShell's job, and it's already solid. Scout's own contribution is narrower and specific: durable decision provenance, and tying a decision to its real-world consequence, which general-purpose enforcement tooling doesn't keep around.

Roadmap

1. Confirm the baseline Verify exactly what OpenShell already provides for free, so Scout only builds what's genuinely missing rather than duplicating it.
2. Register the extension Stand up Scout as a real OpenShell extension service, answering both the control-plane and data-plane contracts, inside OpenShell's own latency budget.
3. Durable evidence Record boundary decisions in a permanent, queryable store — not just a log line — without slowing down the decision path itself.
4. Consequence linkage Connect a decision to what the agent actually did afterward, so an incident can be traced back to the decision that permitted it.
5. Prove agent-independence Run two genuinely different agent harnesses against one unmodified Scout service and confirm the same policy produces the same verdicts — the real test of "works with any agent," not just a design claim.
6. Security review and write-up A proper threat-model pass, then a public write-up of the work as part of a PhD application.

This is a roadmap, not a changelog — nothing above is claimed as finished until it's been verified. A fuller research write-up is in progress.

Get in touch

If you'd like to discuss the research, reach out directly.