OpenSSF Community Day Europe 2026

We give agents our full filesystem permissions because that is how Unix works. We give them network access because they need to call APIs. We give them access to credentials and shell history not because they need any of it, but because we have not built the tooling to say: you can have this, but not that.

This talk is about building that tooling, shipping it, and being honest about what it does and does not solve.

nono enforces per-tool-call restrictions at the kernel level using Linux Landlock. Real credentials never exist inside the agent's execution context. The audit log is written by a process outside the sandbox that the agent cannot reach. The kernel does not negotiate. Once the sandbox is applied it is irreversible.

We show it working in production: Kubefence, a Red Hat Kubernetes NRI plugin, and the nono-py integration being merged into Microsoft's agent-governance-toolkit. The Secure Agentic Framework gives us a shared language for which attack classes this addresses. We will walk through that map carefully because an accurate map is needed for an agentic security model.