A Bouncer Architecture for AI Coding Agents: Deterministic Guards Beat LLM Judges by 11,200×

Neurosymbolic reference monitor for agentic coding harnesses achieves perfect attack blocking with zero false positives at 12.7μs — while an LLM judge rejects 98.3% of legitimate work.

Imagine a nightclub where the bouncer is also a philosopher. Every time someone walks up, the bouncer launches into a 142-millisecond Socratic dialogue about whether you belong inside — and 98% of the time tells regulars to go home. Now replace that bouncer with a metal detector: deterministic, 12.7 microseconds, zero false IDs, catches every weapon. That's the core mechanism of this paper. AI coding harnesses — tools like Cursor, Devin, or OpenHands that wire language models to shells, filesystems, and network sockets — are essentially automated Living-off-the-Land (LotL) platforms. The same binaries a developer uses legitimately (bash, curl, find) are what an attacker uses after injecting instructions into retrieved content. The paper argues security in these systems is a structural property of the cognitive architecture and permission composition, not something you bolt on by asking another LLM 'does this look safe?' ActiveSecHarness is built around a principle the authors call Separation of Intelligence and Authority. The AI model is intelligent but not authorized; the deterministic guard is authorized but not intelligent. Four Trust and Authority Rings partition privileges, with Ring 0 enforcing OS/tool-level guards that cannot be reasoned around, argued with, or prompt-injected. This is the metal-detector layer. The system uses Macaroon-inspired HMAC capability tokens — cryptographic bearer credentials that can be attenuated (restricted further) but never escalated — to enforce least privilege across the ring hierarchy. The second structural contribution is a 2D product taint lattice combining trust provenance and sensitivity classification. Every artifact in the workspace carries a taint label tracking where it came from and what sensitivity level it holds. This prevents 'secret laundering' — the attack pattern where an agent reads a secret, writes it to an intermediate file, then exfiltrates that file because the intermediate lacks the original's security label. A coarse Boolean taint system blocks this but also blocks 83.3% of benign workflows. The 2D lattice achieves perfect attack blocking with zero false positives by tracking both dimensions simultaneously. The evaluation uses 252 fixtures: 120 attack scenarios, 120 benign operations, and 12 multi-step kill chains. The headline comparison is devastating for LLM-as-a-Judge: a local qwen3:4b judge running at 142.3ms latency refuses 98.3% of benign work — meaning it's functionally unusable for real development. Ring 0 deterministic guards achieve ABR (Attack Block Rate) of 1.000 and FPR (False Positive Rate) of 0.000 at 12.7μs, which is 11,200× faster. The kill-chain ablation is equally stark: an oracle Conseca-style stateless policy misses 4 of 12 kill chains (ABR=0.667) because multi-step attacks cross the boundary between individually-innocent steps. The architectural insight that matters most is the taint lattice ablation. Boolean taint (trusted/untrusted) catches all attacks but nukes benign workflows — 83.3% false positive rate. The 2D product lattice (trust × sensitivity) maintains perfect blocking while dropping FPR to zero at roughly 20μs per step. This is the paper's sharpest contribution: showing that the dimensionality of your taint tracking directly determines the usability-security tradeoff, and that two dimensions are enough for the tested scenarios. The honest limitation is scope. All 252 fixtures were designed by the authors. There is no community benchmark for agentic coding security — this paper is essentially proposing one while also winning on it. The 12 kill chains are plausible (prompt injection, secret exfiltration, privilege escalation) but represent the authors' threat model, not an adversarial red team's. The LLM judge comparison, while dramatic, uses a 4B-parameter model; a frontier model might perform better, though likely not 11,200× better. The real question this paper raises for the field is whether agentic coding harnesses should be secured by reasoning (more LLM evaluation) or by structure (deterministic enforcement with cryptographic tokens). This paper bets heavily on structure, and the numbers — within the authors' own evaluation — are overwhelming.