AI agent security controls: hard boundaries or soft requests?

After comparing the public documentation of six vendors, BeyondTrust's Vice President of Product Strategy proposed that AI agent security controls fall into hard boundaries that agents cannot bypass and soft requests that depend on continuous cooperation from the agent or host, with most products on the market belonging to the latter. Taking the Claude Code documentation as an example, deny rules do not cover subprocesses such as Python that read and write files on their own, and a separate sandbox is needed to intercept at the operating system layer; Endor Labs' documentation also acknowledges that its hooks are imperative controls, not a tamper-proof runtime. The author cites multiple studies showing that content detection can raise the cost of attack but does not constitute a boundary, such as Anthropic reducing the injection success rate from 23.6% to 11.2% in Claude for Chrome testing, and CAISI and UK AISI raising the success rate of a model ranked high in hijacking defense evaluations from 11% to 81% through attacks not covered by the benchmark.