Broad discovery should not mean broad source collection
Agent security teams need to know which workloads, agents, tools, execution boundaries and knowledge paths exist. They also need to understand where sensitive content or excessive sharing can create downstream impact.
AgenticDome uses bounded metadata contracts for those questions. The public SDK can collect generic framework and execution descriptors, but the proprietary method for identifying and assessing interception points remains in private AgenticDome services. Source code is not uploaded as part of that analysis path.
For content decisions, raw text or transcripts may be inspected inside the assigned production runtime under tenant policy. The portal receives a bounded evidence record containing digests, modalities, labels, verdict and detector version; it does not retain the raw content. Images, audio and video require extracted text/transcripts or trusted upstream labels—the runtime does not claim a general OCR or media-understanding pipeline.
What changes when AgenticDome is in the path
Correlate tenant-scoped workload, runtime, scan, tool and coverage metadata. Apply the effective production content policy—global defaults followed by the tenant override—to bounded text, JSON, code, document, image, audio or video descriptors. Store only machine-verifiable content evidence. For selected Microsoft sites, inspect Graph permission metadata without downloading file contents or retaining names, and require an exact verified action before revoking a supported non-inherited permission.
Three connected controls, with explicit privacy boundaries
Broad bounded discovery
Bring runtime, scan, workload, agent, tool and knowledge-path evidence together without shipping proprietary analysis in the SDK.
Unified content contract
Represent text, JSON, code, documents, images, audio and video consistently through digests, extracted representations and trusted labels.
Tenant policy decisions
Redact configured PII/secrets or labels, block configured labels or sensitive output, and record the effective policy relationship.
Knowledge remediation
Find broad, anonymous and external Microsoft sharing metadata and approval-gate removal of an exact supported permission.
What “multimodal” means in this contract
Modalities share one evidence and policy envelope. Textual formats can be inspected directly within configured bounds. Images and media must arrive with trusted labels or an extracted text/transcript supplied by an approved upstream component. AgenticDome does not claim that this contract itself performs OCR, speech recognition or arbitrary video understanding.
How AgenticDome creates the control point
1. Collect bounded descriptors
Identify tenant workloads, frameworks, tools and candidate protection points using generic metadata; keep proprietary analysis private.
2. Evaluate in the assigned runtime
Apply deterministic sensitive-entity checks and the effective tenant content policy before the caller uses the inspected representation.
3. Return privacy-bounded evidence
Record modality, MIME type, content digest, labels, verdict, detector version and latency with raw_content_retained set to false.
4. Inspect Microsoft permission metadata
Enumerate selected Graph drives/items and permissions without downloading file bodies or retaining item names and principal identities.
5. Remediate through verified execution
Require tenant-admin approval, a bound execution receipt and Microsoft confirmation before recording a permission removal outcome.
What this changes for real teams
Find the unprotected refund executor
“We know the framework is installed, but not which real tools bypass protection.”
AgenticDome contribution: Bounded discovery and runtime coverage correlate declared and observed protection points while keeping proprietary interception analysis outside the public SDK.
Apply content policy before reuse
“Sensitive returned content must be blocked or redacted before it re-enters an agent loop.”
AgenticDome contribution: The assigned runtime applies configured label and sensitive-entity controls and returns a replacement-required or blocked verdict with bounded evidence.
Reduce risky knowledge access
“We need to find and remove anonymous or external sharing without copying documents into another portal.”
AgenticDome contribution: Selected Graph permission metadata is analysed without content download; supported removal is exact, approval-gated and outcome-recorded.
The risks this helps contain
| Risk | Why it matters | Public AgenticDome control |
|---|---|---|
| Proprietary logic exposed in public SDK | Publishing interception analysis would weaken intellectual-property controls and make tampering easier. | Keep the SDK limited to bounded generic descriptors and execute proprietary analysis in private AgenticDome services. |
| Raw content retained centrally | Central copies increase privacy, residency and breach impact. | Inspect within the assigned runtime and persist only digests, labels, verdicts and other bounded evidence in the portal. |
| False multimodal assurance | A modality label does not prove the runtime extracted meaning from an image, recording or video. | Require approved extracted text/transcripts or trusted upstream labels and identify the inspection source in evidence. |
| Over-broad Microsoft remediation | Removing the wrong grant can interrupt legitimate access. | Scope discovery to selected sites, keep an opaque exact locator, reject inherited grants and require verified execution for one permission. |
A practical path to production
Define allowed metadata
Document the bounded fields, retention and tenant scope for discovery and content evidence.
Set production labels
Choose block/redact labels and sensitive-output behavior through the tenant policy release pipeline.
Approve extractors
Treat OCR, transcription and upstream classification as separate trusted components with their own controls.
Review each removal
Require the tenant administrator to approve the exact non-inherited Microsoft permission before execution.
Where this control ends
AgenticDome bounded discovery is not a universal endpoint or SaaS inventory. Its content contract is not a general OCR, transcription, document-classification or enterprise DLP replacement. Microsoft discovery is limited to configured sites, Graph permissions and accessible metadata; it does not infer all semantic knowledge risk. Customers remain responsible for source systems, Purview and native labels, IAM, retention, privacy assessment and recovery.
Current lifecycle note
Content decisions use the effective production policy synchronized to the assigned runtime. A SaaS-admin template has no tenant effect until the customer creates a draft, reviews the available impact projection, canaries and promotes it. Portal, SDK and runtime releases must support the same evidence schema.