An SoK argues the agent is already the kernel, and names the mediation gap that cannot be closed deterministically

arXiv·medium signalXBlueskyLinkedInCopy link

arXiv 2609.23700 (2026-09-20) systematizes agent security around one distinction: a boundary crossing mediated over provenance admits a deterministic check, while one mediated over content semantics does not. The two semantic judgments with no sound mediator are separating data from instruction in untrusted input and separating an authorized action from an unauthorized one, which leaves an irreducible residual wherever inputs and actions are not restricted to an enumerated set in advance. The useful move for builders is the resulting spectrum: an attack-success number is either deployment debt, meaning a sound mediator exists and was not used, or a structural gap.