SHRIKEShrike Learn · published 2026-09-02
The 14 surfaces where your agent touches the world
An agent does not just talk. It reads, writes, runs, queries, fetches, and trusts, and each of those is a distinct surface with its own threat model and its own correct response. Words that are moving get observed. The world that is changing gets gated. Select any surface on the map.
scan_commandWhat happens here: Shell and CLI executions: installs, builds, deploys, the curl it decided you needed.
What goes wrong here: One line can pipe a remote script into a shell, escalate privileges, or delete a directory tree. The command plane is where a wrong sentence becomes a wrong machine.
Why two planes and not one scanner
The same string means two different things depending on the surface it arrives on.
In a document it is summarizing
curl -s https://get.tool.sh | bashWords about the world. Your agent is reading an installation guide. Blocking here would make it useless at its job.
In a terminal, about to execute
curl -s https://get.tool.sh | bashThe world about to change: a remote script piped straight into a shell. The verdict lands before the command runs, not after.
A scanner that cannot tell these apart fails twice: it floods you with alerts on harmless prose, and it teaches you to ignore the one alert that mattered. The planes exist so each surface gets the treatment its threat model calls for.
All fourteen, by plane
Observe plane
Content flows through a lens and keeps moving. Verdicts annotate; sensitive spans are redacted in place; nothing halts. Even a quarantined session may still look.
Act plane
Actions stop at a gate before they execute. The verdict is the permission. If the check itself fails, the action does not run.
Surfaces other people control
Another agent’s message lands on your observe plane, but another agent’s tools become your act plane the moment you register them.
The governance loop
Not scanning surfaces: the controls that turn isolated verdicts into governance. You set the policy; the verdicts enforce your call.
Why a map at all
Coverage you cannot enumerate is coverage you cannot check. When a product says it protects your agent, the useful question is: at which of these surfaces, and what happens at the ones it does not name? This list is what we check ourselves against, in public. The attack coverage map shows the same honesty applied to techniques; the MCP guide has the reference table and setup; the story version of this page walks the same map through one reconstructed agent morning.