Mohit Kumar

Honestly, neither. Warden runs before anything executes. It just reads the config (LangChain, CrewAI, Assistants, .mcp.json) and looks at what the agent can do once it's all wired together, so it's framework-agnostic but can't stop a call in flight. The thing I look for is combinations, not tools. Read-secrets is fine. Send-email is fine. Both together is an exfil path, and if the same agent also reads a webpage, someone else gets to trigger it. Then it'll strip the config down to least privilege and fail CI on it. Runtime is the gap and it's the harder half. How are you doing it? Different config per task, or decided live at dispatch?

Thanks, Kartik! That's a great observation. You're absolutely right that inspecting individual components isn't sufficient if the agent can still be induced to chain otherwise safe tools into a risky workflow. That's actually one of the motivations behind Warden in Bulwark. It analyzes agent assemblies, capability combinations, and privilege boundaries rather than evaluating tools in isolation. The policy layer and "safe parts, dangerous combinations" problem is exactly where I think AI security needs to evolve. There's definitely more work to do around prompt-injection-driven tool orchestration, and it's an area I want to keep expanding. Thanks for raising it!

Thanks, Mateo! That's a great perspective. I especially agree that the bottleneck has shifted from writing code to evaluating architecture, trust boundaries, and security assumptions. That's one of the motivations behind Bulwark. AI can generate or assemble systems incredibly quickly, but someone still needs to verify what is being integrated, why it's trusted, and whether the resulting agent has capabilities beyond what it actually needs. AI can accelerate implementation, but accountability and security architecture remain human responsibilities.