A Safety and Governance Layer for Open Agent Networks

Intuno is an open-source developer-experience layer on top of agent protocols, plus a hosted network. If Intuno is the layer developers use to publish and discover agents, it controls the chokepoint through which safety defaults can flow.

A hosted network that refuses to route tasks to agents without signed identity, declared capabilities, and audit trails makes safety a feature of the platform, not a bolt-on — precisely because it controls the developer workflow and the hosted registry. This is the HTTPS-by-default moment for agent networks.

Multi-agent networks built on A2A, MCP, and related protocols face concrete, demonstrated threats. This isn't speculative — several have published CVEs, working exploits, and academic reproductions.

Prompt Injection Propagates Like a Virus

Researchers have demonstrated “Prompt Infection” — self-replicating malicious prompts with a replication factor that can exceed 1 in connected agent networks. A single compromised agent's output becomes an injection vector for every downstream agent.

Agent Identity Is Trivially Spoofable

A2A agent discovery relies on Agent Cards served at well-known URLs. The spec supports optional signatures but does not mandate them. Since routing compares agent descriptions in natural language, the attack surface is the English language itself.

Runaway Autonomous Actions

Documented incidents include an email agent performing bulk deletions while ignoring remote stop commands, a scheduling agent sending 300 calendar invites in one hour, and reports of production resources being deleted by an autonomous assistant.

Ship First — Weeks, Not Months

• Cryptographic agent identity — every message carries a signature proving which agent sent it; unsigned agents can't be discovered on the hosted network.
• Policy engine — declarative policies evaluated before a request reaches the agent: budget caps, skill-based authorization, rate limiting.
• Hash-chained audit logs — each message linked to its predecessor, periodically anchored to a public transparency log.
• Kill switch — a revocation endpoint that immediately revokes an agent's card and fails in-flight tasks.

Ship Second & Third

Human-in-the-loop checkpoints, cross-agent prompt-injection detection, PII redaction at protocol boundaries, and rule-based output checks. Then capability-based permissions, reputation and trust scoring, and sandboxed execution for untrusted agents.

Structural commitments are hardest to reverse and most effective. Legal commitments are intermediate. Promissory commitments are worthless.

AGPL licensing, foundation governance, public append-only logs, and pre-registered safety metrics are irreversible commitments. AI-principles statements and blog posts about responsible development are not.

Three things that matter more than everything else

First, ship signed identity. Making cryptographic agent identity mandatory on the hosted network is the single highest-leverage safety intervention — it transforms agent networks from anonymous to attributable, and every other safety feature depends on knowing who sent a message.

Second, commit structurally, not verbally. Third, be the safety layer for open agent protocols: “I need my agents to be safe, auditable, and trustworthy on the open network, and I want it to be as easy as adding one import.”