Granted Patent B1

US 12,619,741 · App. 19/418,156 · Granted May 5, 2026

Inventor: Adam Vincent (McLean, VA)

Assignee: Bricklayer AI Inc.

G06F21/577G06F2221/034

Abstract

Claims (46)

1 . A method for enforcing policy controls in an AI agent workflow, comprising:

providing a computer processor including a memory;

providing at least one security label for components of the AI agent workflow;

wherein the components of the AI agent workflow include at least one AI agent, at least one tool, at least one data source, and at least one memory;

intercepting via a run-time enforcement engine a request by a requesting component of the AI agent workflow to perform an action on a target component;

retrieving a security label associated with the requesting component and a security label associated with the target component;

matching the security label associated with the requesting component against a set of predefined policy rules, wherein each rule of the set of predefined policy rules specifies permitted or restricted actions based on security label attributes;

evaluating a contextual condition associated with the requesting component;

determining, based on the set of predefined policy rules and the evaluated contextual condition, whether to allow, deny, or conditionally permit the request; and

executing, blocking, or auditing the action based on the determination.

2 . The method of claim 1 , wherein the at least one security label includes an identity field, a function role field, a data sensitivity classification, and an execution level designation.

3 . The method of claim 1 , wherein the action includes reading from a memory element, writing to the memory element, invoking a plugin and/or external service, delegating a task and/or sub-task from a first of the at least one AI agent to a second of the at least one AI agent, escalating the task and/or sub-task to a higher level AI agent, and/or executing a procedure.

4 . The method of claim 1 , further comprising generating an audit log for each intercepted request, wherein the audit log includes a subject label, an object label, an action attempted, a decision result, and a timestamp.

5 . The method of claim 1 , wherein the set of predefined policy rules includes wildcard or pattern-based matching for the at least one security label and wherein the contextual condition includes evaluating dynamic run-time attributes, including time of day, case assignment, agent team membership, and/or task lineage.

6 . The method of claim 1 , wherein the at least one AI agent includes a tier 1 alert triage agent, a threat intelligence enrichment agent, a vulnerability management agent, and/or an incident response reporting agent.

7 . The method of claim 1 , wherein the action includes execution of a predefined security operations center (SOC) procedure, wherein the SOC procedure includes a phishing alert triage, a ransomware incident response, executive summary reporting, and/or vulnerability remediation planning.

8 . A method for enforcing policy controls in an AI agent workflow, comprising:

providing a computer processor including a memory;

including a procedure within the AI agent workflow;

providing a plurality of components within the AI agent workflow;

assigning a procedure-level security label to a composite task within the AI agent workflow;

wherein the plurality of components of the AI agent workflow includes at least one AI agent, at least one tool, at least one data source, and at least one memory;

wherein the composite task includes at least one sub-task;

propagating the procedure-level security label to the at least one sub-task within the procedure executed by one of the plurality of components within the AI agent workflow;

enforcing at least one policy authorization by a run-time enforcement engine execution of the at least one sub-task under the propagated procedure-level security label;

maintaining an association between each of the at least one sub-task and the one of the plurality of components calling the at least one sub-task; and

auditing the at least one sub-task executed by the one of the plurality of components within the AI agent workflow under the propagated procedure-level security label.

9 . The method of claim 8 , further comprising limiting propagated actions within the composite task based on a native label of an executing AI agent to prevent unauthorized privilege escalation.

10 . The method of claim 8 , wherein the run-time enforcement engine includes predefined security operating center (SOC) rulesets for escalation of alerts based on label elevation logic, enforcement of sensitivity containment across reporting procedures, and/or dynamic enrichment permissions based on data sensitivity and source trust levels.

11 . The method of claim 8 , wherein the procedure includes a series of tasks and/or sub-tasks operable to be executed by any of the at least one AI agent within the AI agentic workflow.

12 . The method of claim 8 , wherein the procedure-level security label includes an identity, a function role, a data sensitivity classification, and an execution level.

13 . The method of claim 8 , further comprising a temporary override function such that the run-time enforcement engine allows the at least one sub-task until the temporary override is terminated.

14 . A system for enforcing policy controls in an AI agent workflow, comprising:

at least one computer processor including a memory;

a plurality of AI agents each configured to perform tasks and/or sub-tasks in a collaborative workflow;

a security label registry associating security labels with components within the AI agent workflow;

a policy engine operable to store and match policy rules based on the security labels;

a run-time enforcement engine operable to intercept an attempted action, resolve security labels associated with requesting components and security labels associated with target components, evaluate the policy rules and contextual conditions, and return a decision to allow, deny, or audit allowed actions;

wherein the components within the AI agent workflow include the plurality of AI agents, at least one tool, at least one memory, and at least one data source; and

wherein the at least one memory is operable to store the tasks and/or sub-tasks, results for completed tasks and/or sub-tasks, and a shared memory state.

15 . The system of claim 14 , wherein the run-time enforcement engine is operable to support a break-glass override function, a policy versioning rollback, and a simulated policy enforcement for policy validation.

16 . The system of claim 14 , wherein the plurality of AI agents operate asynchronously and across different execution levels, and wherein the run-time enforcement engine ensures consistent policy enforcement across distributed execution contexts.

17 . The system of claim 14 , wherein the run-time enforcement engine is operable to log each of the intercepted attempted actions.

18 . The system of claim 14 , wherein the at least one memory includes saving a series of tasks and/or sub-tasks as a procedure.

19 . The system of claim 14 , wherein the security labels include an identity, a function role, a data sensitivity classification, and an execution level.

20 . The system of claim 14 , wherein resolving the security labels includes the run-time enforcement engine comparing a subject type, role match, sensitivity match, and level match to an object type, object role match, object sensitivity match, and an object level match.

Assignments (1)

References Cited (20)