AI智能体安全是当前最棘手的工程问题之一，AgentTrust 用自进化信任层解决了规则无法覆盖语义攻击的痛点，做智能体安全或自动化运维的团队可以直接参考其架构设计。
AgentTrust 提出了一种针对AI智能体动作的信任层，能根据威胁类型（词法或语义）决定是否允许、警告、阻止或升级操作。词法威胁可通过确定性规则处理，而语义威胁（如表面相似但意图不同的动作）则依赖LLM判断。该系统通过自学习机制，在语义攻击为主的语料上，将规则准确率从48%提升至83.6-85.2%，且误报率极低。AgentTrust v2 采用双存储系统：对词法威胁蒸馏出确定性规则以降低成本，对语义威胁使用带验证的RAG记忆，将语义准确率提升13个百分点。在45000个动作的端到端回放中，LLM调用率从50%降至44%，准确率从71%升至80%，且未误阻任何良性动作。
AgentTrust: A Self-Improving Trust Layer for AI-Agent Actions
AI agents increasingly take consequential actions -- shell commands, cloud operations, and arbitrary tool-calls -- so a trust layer must decide, per action, whether to allow, warn, block, or escalate. We argue that the right way to reason about such a layer is by threat type. Lexical (fixed-signature) threats, where danger lives in a stable token, are decidable by deterministic rules; semantic (intent-dependent) threats, where a benign and a malicious action share the same surface, are out of reach for rules by construction. We make this concrete with a negative proof: a determined, hand-authored cloud rule pack lifts held-out accuracy only 48 to 56% overall and moves the semantic categories by 0pp (data_db 29 to 29, observability 59 to 59, supply_chain 50 to 50), while a strong LLM judge carries exactly those categories. We give the judge a self-learning capability: on a corpus that is mainly semantic attacks it nearly doubles rule accuracy (48% to 83.6-85.2%) with near-zero false-blocks, and this holds across two model providers. We turn this into a self-improving dual-store system: the judge distills a growing deterministic rule floor on lexical threats (cheaper over time) and feeds a guarded RAG memory on semantic threats (a verdict-cache fails -- surface-twins collapse to ~58% -- so a corroboration guard lifts semantic accuracy +13pp, 70 to 84). The result is what sets AgentTrust v2 apart from its static v1 predecessor: a trust layer that self-evolves from its own stream of decisions -- cheaper on the lexical class (it distils its own rules) and smarter on the semantic class (it accrues guarded precedent), while never hard-blocking a benign action. An end-to-end online replay shows the judge-call rate falling (50% to 44%) and judge-domain accuracy rising (71% to 80%), with 0 benign hard-blocks across 45,000 actions.