1. Executive Summary

Bartholomew is an open-source, deterministic cryptographic invariant gateway designed to secure autonomous AI agent workflows across local environments, cloud containers, and multi-agent swarms.

Unlike probabilistic prompt filters, Bartholomew provides sub-50 microsecond in-process Abstract Syntax Tree (AST) static analysis, epistemic provenance grounding, and FIPS 186-5 / RFC 8785 Ed25519 cryptographic execution receipts.

2. Formal Threat Model & Adversary Assumptions

We model an adversary with the following capabilities in an agentic runtime environment:

• Indirect Prompt Injection: Adversaries who inject natural language exploits into web pages, code repositories, or API payloads to coerce an LLM into calling destructive tools (rm -rf, DROP TABLE, unauthorized fund transfers).
• Multi-Agent Confused Deputy Exploitation: Forged message exchanges in distributed swarms (LangGraph, AutoGen, CrewAI) triggering unauthenticated actions across agent boundaries.
• Infinite Loop & Budget Exhaustion: Adversaries or buggy prompts causing agents to enter repetitive retry spirals that deplete API budgets and system resources.

3. In-Process Library Architecture (Zero-Daemon Principle)

To eliminate the attack surface and confused-deputy risks associated with local background proxy daemons, Bartholomew is architected as an embedded in-process library:

from btp_guard import Guard

# In-process execution with ZERO network sockets and ZERO background daemons
guard = Guard(spend_cap=100.0, max_retries=5)

@guard.protect
def execute_database_mutation(sql_query: str):
    # Evaluated in <5.0 µs directly in caller memory
    return db.execute(sql_query)

4. Comparison Matrix: Native Confirmation Dialogs vs. Invariant Gates

Security Capability	Native Human Dialog Popup	Bartholomew Invariant Gate
Alert Fatigue Resistance	Fails under high volume (humans click "Allow" blindly)	100% deterministic mathematical evaluation
Unattended Autonomous Swarms	Blocked (cannot manually click 1,000s of dialogs/hr)	Autonomous pre-flight evaluation in <5 µs
Loop & Rate Damping	None (allows infinite repetitive retries)	Law of Diminishing Marginal Utility (MU = e^(-λn))
Spend Quota Enforcement	None (no cumulative balance tracking)	Monotonic cumulative budget caps ($500.00 max)
Cryptographic Attestation	None (zero proof generated)	RFC 8785 Ed25519 verifiable receipts
Audit Non-Repudiation	Unsigned text logs	Immutable SHA-256 Merkle inclusion proofs

5. Cryptographic Standards Adherence

• RFC 8785 (JSON Canonicalization Scheme): Byte-exact deterministic hashing across Python, C, and Go.
• FIPS 186-5 / RFC 8032 (Ed25519): High-security elliptic curve digital signatures verifiable offline in 175 µs.
• FIPS 180-4 (SHA-256): Binary Merkle tree audit roots for zero-knowledge SOC 2 compliance verification.