Question 1

What are the challenges of securing agentic AI?

Accepted Answer

Agentic AI creates attack surface that grows faster than traditional defenses can handle. Six fundamental challenges:

| Challenge | Why It's Hard |
|-----------|---------------|
| No syntactic boundaries | Instructions and data look the same to an LLM |
| Non-deterministic execution | Same prompt can produce different paths |
| Semantic ambiguity | Pattern matching can't catch meaning-based attacks |
| Stateful manipulation | Multi-turn context enables gradual compromise |
| Dynamic prompt chai

Question 2

What is the MACAW Control Plane?

Accepted Answer

The Control Plane is MACAW's cloud infrastructure that coordinates security across your agentic system:

┌─────────────────────────────────────────────────────────────────┐
│                    MACAW Control Plane                          │
│                                                                 │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐          │
│  │   Identity   │  │    Policy    │  │    Agent     │          │
│  │    Bridge    │  │    Store     │  │   Registry   │

Question 3

What are the principal types in MACAW?

Accepted Answer

MACAW has three principal types representing "who is making the request":

| Principal Type | Description | Identity Source |
|----------------|-------------|-----------------|
| User | Human identity | JWT from your IdP (Okta, Auth0, Azure AD, etc.) |
| Service | Backend service | Service credentials, long-lived |
| App | Application | Application credentials |

How they're used:

User principals:     Alice calls an AI assistant
Service principals:  Background worker processes data
App princip

Question 4

Why do tools have their own cryptographic identity?

Accepted Answer

Every tool in MACAW gets its own Ed25519 keypair. This is a deliberate security design for byzantine fault tolerance:

Traditional approach:
┌─────────────────────────────────────────┐
│           Agent (one keypair)           │
│  ┌───────┐ ┌───────┐ ┌───────┐         │
│  │Tool A │ │Tool B │ │Tool C │         │
│  └───────┘ └───────┘ └───────┘         │
└─────────────────────────────────────────┘
Problem: If agent is compromised, all tools are compromised

MACAW approach:
┌───────────────────

Question 5

How does a request flow through MACAW?

Accepted Answer

Complete request flow from caller to execution:

┌──────────────┐
│   Caller     │  1. Signs request with private key
│ (User/Service│     Includes: operation, parameters, identity
│  /App)       │
└──────┬───────┘
       │
       ▼
┌──────────────────────────────────────────────────────────────┐
│                    MACAW Control Plane                        │
│                                                               │
│  • Routes request to appropriate callee                       │
│

Question 6

What are policy perspectives?

Accepted Answer

MACAW computes effective policy by combining multiple perspectives - different viewpoints on what should be allowed:

| Perspective | What it captures | Example |
|-------------|------------------|---------|
| Caller Intent | What the caller says they want to do | "I only need read access" |
| System Rules | Organization-wide constraints from roles/org | "Finance team can access financial tools" |
| Service/App Policy | What the service itself allows | "This API only exposes query operations" |

Question 7

What happens at the PEP?

Accepted Answer

The Policy Enforcement Point (PEP) is where security is actually enforced. In MACAW, PEPs are embedded in tools, not in a central gateway.

Multi-layer verification at the PEP:

Request arrives at PEP
         │
         ▼
┌─────────────────────────────┐
│  1. SIGNATURE VERIFICATION  │
│     • Lookup caller's public key from registry
│     • Verify signature on request
│     • Reject if invalid
└─────────────┬───────────────┘
              │
              ▼
┌─────────────────────────────┐
│  2.

Question 8

What is the Activity Graph?

Accepted Answer

The Activity Graph is MACAW's real-time visualization of your entire agentic system:

┌─────────────────────────────────────────────────────────────────┐
│                      Activity Graph                              │
│                                                                  │
│         [User: Alice]                                           │
│              │                                                   │
│              ▼                                                   │
│

Question 9

How does MACAW's audit logging work?

Accepted Answer

MACAW captures all AI agent interactions through a two-tier logging architecture:

Tier 1: Events Log (High-volume telemetry)
- All interactions recorded in real-time
- Unsigned for performance
- Exported to OTEL backends for live monitoring

Tier 2: Audit Log (Compliance-critical)
- Cryptographically signed entries
- Hash-chained for tamper-evidence
- Subset of events for regulatory requirements

Event Categories:

| Category | Events Captured |
|----------|-----------------|
| Request | reques

Question 10

How does MACAW scale?

Accepted Answer

MACAW's architecture is designed for scale through distributed enforcement:

Traditional centralized approach:
┌──────────────────────────────────────────────────┐
│              Central Policy Gateway               │
│  (bottleneck - all traffic flows through here)   │
└──────────────────────────────────────────────────┘
         ▲         ▲         ▲         ▲
         │         │         │         │
      Agent A   Agent B   Agent C   Agent D

MACAW distributed approach:
┌───────────────────

Architecture & Technical Concepts