--- title: ActPlane: Pushing Agent Harness Enforcement Down to... description: ActPlane is an eBPF-based policy engine that enforces AI agent constraints at the Linux kernel syscall layer, addressing the fundamental gap between where... canonical: https://daily.dev/posts/actplane-pushing-agent-harness-enforcement-down-to-kernel-ebpf-kdloogznn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ActPlane: Pushing Agent Harness Enforcement Down to Kernel eBPF | daily.dev og:description: ActPlane is an eBPF-based policy engine that enforces AI agent constraints at the Linux kernel syscall layer, addressing the fundamental gap between where... og:url: https://daily.dev/posts/actplane-pushing-agent-harness-enforcement-down-to-kernel-ebpf-kdloogznn og:image: https://api.daily.dev/og/posts/kdLOoGzNn.png og:image:alt: ActPlane: Pushing Agent Harness Enforcement Down to Kernel eBPF og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ActPlane: Pushing Agent Harness Enforcement Down to Kernel eBPF **[eunomia eBPF Blog](https://daily.dev/sources/eunomia)** · 20 min read · 0 upvotes · 0 comments ## Summary ActPlane is an eBPF-based policy engine that enforces AI agent constraints at the Linux kernel syscall layer, addressing the fundamental gap between where constraints are declared (prompts, tool APIs, sandboxes) and where side effects actually occur. It introduces label propagation across process lineage and file I/O boundaries, plus temporal predicates via a 'since' clause, enabling constraints like 'run tests before committing' or 'access prod.db only through the migration tool.' Unlike sandboxes that return opaque EPERM errors, ActPlane delivers human-readable feedback explaining why a rule fired and what the agent should do instead — achieving a 97.7% agent recovery rate after violations versus 31.4% without feedback. The system runs as a Rust binary using CO-RE eBPF programs (no compilation toolchain needed), requires Linux 5.8+ with BTF support, and integrates with Claude Code and Codex via hook systems without modifying the agent frameworks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why can't prompt constraints or MCP tool guards reliably prevent an AI agent from running git push? Prompt constraints are probabilistic — in long contexts, early rules lose attention weight and agents can route around them indirectly (e.g., writing a Makefile that calls rm -rf). Tool-layer guards like MCP gateways see only the registered tool entry point and miss subprocesses spawned inside agent-generated scripts. An agent can write a Python script containing subprocess.run(['git','push']), execute it, and push code without ever calling the git tool directly. _Teams enforcing AI agent policies in production track enforcement gaps like these on daily.dev._ ### What Linux kernel version and capabilities does ActPlane require to run? ActPlane requires Linux 5.8 or later with BTF support (the /sys/kernel/btf/vmlinux file must be present). Loading the eBPF programs requires root or CAP_BPF plus CAP_SYS_ADMIN privileges, though once loaded the target command drops back to the current user. Block-mode enforcement additionally depends on BPF-LSM, which not all distributions enable by default. macOS and Windows are not supported. _Developers choosing between eBPF-based agent enforcement tools find the tradeoff discussions on daily.dev useful before committing to a stack._ ### What is the agent recovery rate difference between getting actionable feedback vs. a plain EPERM when an eBPF policy blocks an operation? With semantic feedback explaining why a rule fired and what to do instead, agent recovery rate after a detected violation reaches 97.7%. Without feedback — receiving only an opaque EPERM or Permission denied — recovery drops to 31.4%. The difference is that actionable feedback lets the agent revise its plan rather than retrying the same blocked action and eventually abandoning the task. _Engineers building AI agent harnesses and weighing enforcement strategies find real-world data points like this on daily.dev._ ## Similar posts on daily.dev - [Kernel-Level Ground Truth: Why eBPF is Replacing User-Space Agents for Security Observability](https://daily.dev/posts/kernel-level-ground-truth-why-ebpf-is-replacing-user-space-agents-for-security-observability-92jvpmrxl) · InfoQ · 0 upvotes · 0 comments - [How eBPF Empowers Developers to Observe Inside the Linux Kernel in a Safe and Unintrusive Way](https://daily.dev/posts/how-ebpf-empowers-developers-to-observe-inside-the-linux-kernel-in-a-safe-and-unintrusive-way-jhmpnwjer) · InfoQ · 0 upvotes · 0 comments - [Agentic Platform Engineering with GitHub Copilot](https://daily.dev/posts/agentic-platform-engineering-with-github-copilot-1xc31dz7v) · DevBlogs · 3 upvotes · 0 comments - [Out-of-band Policy Engine: governance AI agents can't ignore](https://daily.dev/posts/out-of-band-policy-engine-governance-ai-agents-can-t-ignore-etf3nbo9k) · Redpanda · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/actplane-pushing-agent-harness-enforcement-down-to-kernel-ebpf-kdloogznn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ActPlane: Pushing Agent Harness Enforcement Down to Kernel eBPF","url":"https://daily.dev/posts/actplane-pushing-agent-harness-enforcement-down-to-kernel-ebpf-kdloogznn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/actplane-pushing-agent-harness-enforcement-down-to-kernel-ebpf-kdloogznn"},"datePublished":"2026-08-11T08:54:17.388Z","dateModified":"2026-08-11T09:00:57.017Z","description":"ActPlane is an eBPF-based policy engine that enforces AI agent constraints at the Linux kernel syscall layer, addressing the fundamental gap between where...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b59e04eefe0ea85df0b7e50151b0b12e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b59e04eefe0ea85df0b7e50151b0b12e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"eunomia eBPF Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"eunomia eBPF Blog","logo":"https://media.daily.dev/image/upload/s--z-nTl7TK--/f_auto,q_auto/v1786438304/logos/eunomia?_a=BAMAMicg0","url":"https://daily.dev/sources/eunomia"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/actplane-pushing-agent-harness-enforcement-down-to-kernel-ebpf-kdloogznn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux,ai-agents","timeRequired":"PT20M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"eunomia eBPF Blog","item":"https://daily.dev/sources/eunomia"},{"@type":"ListItem","position":3,"name":"ActPlane: Pushing Agent Harness Enforcement Down to Kernel eBPF"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/actplane-pushing-agent-harness-enforcement-down-to-kernel-ebpf-kdloogznn#faq","mainEntity":[{"@type":"Question","name":"Why can't prompt constraints or MCP tool guards reliably prevent an AI agent from running git push?","acceptedAnswer":{"@type":"Answer","text":"Prompt constraints are probabilistic — in long contexts, early rules lose attention weight and agents can route around them indirectly (e.g., writing a Makefile that calls rm -rf). Tool-layer guards like MCP gateways see only the registered tool entry point and miss subprocesses spawned inside agent-generated scripts. An agent can write a Python script containing subprocess.run(['git','push']), execute it, and push code without ever calling the git tool directly. Teams enforcing AI agent policies in production track enforcement gaps like these on daily.dev."}},{"@type":"Question","name":"What Linux kernel version and capabilities does ActPlane require to run?","acceptedAnswer":{"@type":"Answer","text":"ActPlane requires Linux 5.8 or later with BTF support (the /sys/kernel/btf/vmlinux file must be present). Loading the eBPF programs requires root or CAP_BPF plus CAP_SYS_ADMIN privileges, though once loaded the target command drops back to the current user. Block-mode enforcement additionally depends on BPF-LSM, which not all distributions enable by default. macOS and Windows are not supported. Developers choosing between eBPF-based agent enforcement tools find the tradeoff discussions on daily.dev useful before committing to a stack."}},{"@type":"Question","name":"What is the agent recovery rate difference between getting actionable feedback vs. a plain EPERM when an eBPF policy blocks an operation?","acceptedAnswer":{"@type":"Answer","text":"With semantic feedback explaining why a rule fired and what to do instead, agent recovery rate after a detected violation reaches 97.7%. Without feedback — receiving only an opaque EPERM or Permission denied — recovery drops to 31.4%. The difference is that actionable feedback lets the agent revise its plan rather than retrying the same blocked action and eventually abandoning the task. Engineers building AI agent harnesses and weighing enforcement strategies find real-world data points like this on daily.dev."}}]} ```