BLADE-AGENT-HSM Hardware Root of Trust

Research Mission

The rapid 2026 adoption of autonomous, tool-using AI agents created a security gap that software alone cannot close: when an agent can spend, call tools, and spawn sub-agents on its own, its authority and its record of decisions are only as trustworthy as the software holding them, and that software is exactly what an indirect prompt injection or a compromised host can subvert. The mission of this work is to specify a tamper-evident hardware root of trust that makes an agent's authority tier and audit ledger non-forgeable, so that an agent cannot exceed its granted authority or rewrite its history without breaking the device, and breaking the device leaves evidence.

Problem

Agent permissions today live in software the agent process can read and, under compromise, alter. The logs that should prove what an agent did are written by the same stack being audited. There is no portable hardware that holds the authority tier itself, signs each action with a non-exportable key, and refuses to operate after a physical tamper.

Gap

General-purpose secure elements and TPMs exist, but none binds the specific authority lifecycle of an AI agent (graded tiers, per-tool tokens, spawn-quorum aggregation, deterministic tamper response) to a tamper-evident device that an agent or its host can attach over USB or M.2.

Contribution

BLADE-AGENT-HSM extends the AUTHREX governance framework (validated across six BLADE platforms) into the agentic-AI domain as the seventh BLADE platform and the first hardware root of trust in the family. It is the hardware companion to the AUTHREX-AGENT software shim, contributing a non-exportable-key signing path, TPM-resident tier state, HKDF-derived per-tool tokens, spawn-quorum aggregation, and a deterministic multi-modal tamper cascade, all reproduced by an adversarial high-assurance emulator under 275 deterministic checks.

National Importance

In 2026 the United States and its closest partners moved from encouraging agentic AI to governing it. On 1 May 2026 the Cybersecurity and Infrastructure Security Agency, the NSA AI Security Center, and the Five Eyes cyber agencies issued joint guidance, Careful Adoption of Agentic AI Services, calling for hardware-anchored identity, non-repudiable audit, and least-privilege authority for autonomous agents. The FY2026 National Defense Authorization Act addressed the same problem in Sections 1513 and 6601.

Software controls alone cannot satisfy that guidance, because the software is the attack surface. A hardware root of trust changes the trust assumption: when the signing keys live in an EAL6+ secure element, the authority tier lives in a TPM, and every action is signed by hardware, an attacker cannot escalate an agent past its tier or forge its audit trail without physically defeating the device, and the device records the attempt. This is the principle that secures payment and identity hardware, applied to the authority of autonomous AI.

BLADE-AGENT-HSM, paired with the AUTHREX-AGENT software shim, is a research contribution toward closing that gap. It makes no empirical claims about specific products or incidents, claims no government endorsement, and is a reference design at research-demonstrator maturity.

What Agentic-AI Security Does Not Yet Provide

The market has mature secure elements, TPMs, and a growing set of software frameworks for agent identity and tool permissions. None binds the AI-agent authority lifecycle to a tamper-evident device the agent can carry.

Four Documented Authority Gaps

• Software-only authority. Agent permissions live in configuration the agent process can read and, under prompt injection or host compromise, alter. No hardware holds the authority tier itself and refuses actions above it.
• Forgeable audit. Agent action logs are written by the same software stack being audited. Without a hardware signer and a hash-chained ledger, a record cannot demonstrate the integrity an evidentiary or compliance standard requires.
• No tamper-bound authority. General secure hardware detects tampering but does not tie a tamper event to an agent authority model that zeroizes keys, latches to a halt tier, and records the cause.
• No portable anchor for the lifecycle. Existing devices secure keys, not the agent lifecycle (graded tiers, per-tool tokens, spawn-quorum aggregation). No attachable module makes that lifecycle hardware-rooted.

BLADE-AGENT-HSM addresses all four as an attachable module that integrates over USB-A or M.2 Key-E. It does not run the agent's model; it anchors the agent's authority and the record of it in hardware.

Software Shim Plus Hardware Anchor

BLADE-AGENT-HSM is deliberately one half of a program. The AUTHREX-AGENT software shim implements the authority lifecycle (tiering, deliberation, recovery, ledger) so any agent can adopt it immediately; BLADE-AGENT-HSM then closes the production-readiness gap by making the keys non-exportable, the tier hardware-attested, and the ledger tamper-evident. The same root-of-trust design is already embedded inside the BLADE-EDGE, BLADE-AV, and BLADE-INFRA reference variants; this platform extracts it into a standalone, attachable device.

Together they are a complete answer to the hardware-anchored-identity, non-repudiable-audit, and least-privilege expectations of the CISA, NSA, and Five Eyes agentic-AI guidance.

What the HSM Does: Five-Opcode ABI

BLADE-AGENT-HSM does not run an AI model. It exposes a fixed 64-byte command frame (over USB-HID for the stick, or SPI-slave for the M.2 module) with exactly five authority-bearing operations. The host or the AUTHREX-AGENT shim calls these; the keys and the tier state stay inside the device.

PCR Allocation

The frame carries a 4-byte opcode, a 2-byte length, a payload up to 26 bytes, and a 32-byte HMAC-SHA-256. The full layout is in the Interface Control Document (ICD-AGENT-HSM-001).

Four-Tier Authority, Indicated in Hardware

BLADE-AGENT-HSM holds the four-tier HMAA authority state in the TPM and surfaces it on a tri-colour indicator LED, so the authority state of an agent is visible physically and is not something the agent process can misrepresent.

Provisioning state. During the provisioning ceremony the tier LED shows a slow blue pulse; a green power LED is solid whenever the 3.3V rail is stable. Each agent carries a sealed tool policy (PCR2) that defines its tier ceiling.

Physical Intrusion to Key Zeroization

BLADE-AGENT-HSM is a sealed module on a four-layer board whose inner layers carry an active tamper mesh. Several independent sensing paths feed the deterministic tamper cascade.

Tamper Cascade (Firmware-Defined)

• An interrupt fires on mesh fault, voltage glitch, or thermal alert
• The MCU issues a key-zeroize command to the secure element; private-key slots are wiped
• The TPM extends PCR4 with the tamper cause code, then PCR0 with a T0 lock marker
• A one-time-programmable tamper-latch flag is written so the event survives power cycling
• The alarm LED goes solid red and the piezo buzzer chirps; the device latches to T0

A physical tamper-evident seam label spans the enclosure and tears on opening, with its serial recorded against the device serial number. The response is deterministic: a tampered device stops signing until an authorized re-provisioning ceremony.

Hardware-Signed, Hash-Chained Audit

Every authority-bearing action is signed and recorded so the agent's history is verifiable after the fact.

Non-Exportable Hardware Signing

Each audit entry is signed with an ECDSA P-256 key resident in the EAL6+ secure element, whose extractable attribute is fixed false at provisioning. The private key never leaves the device, so a signature ties each record to a specific physical device identity.

Hash-Chained Ledger and PCR Binding

Each entry references the previous entry's hash, forming an append-only chain that is also extended into TPM PCR1. A periodic TPM quote over the PCR selection provides an attested checkpoint that can be exported and anchored externally.

Signed Golden-Trace Anchor

The reproducibility package includes a deterministic golden trace and a P-384 signed anchor over the event count, the final PCR digests, and the trace SHA-256. The bundled verifier re-derives the PCR chain, checks the ECDSA signature on every entry, and validates the anchor; truncation or substitution fails verification.

Defense-in-Depth Security

BLADE-AGENT-HSM uses a three-layer security architecture anchored in hardware. Because the device is the root of trust, the model protects the keys, the identity, and the integrity of the evidence chain.

Attachable Secure Module - Reference Design

Form Factors

A single 30 mm by 80 mm four-layer PCB supports two enclosures: a USB-A stick (84 by 24 by 9 mm, two-piece clamshell with a tamper-evident seam label) for development, red-team rehearsal, and forensic verification; and an M.2 Key-E module (Type 2280) for production edge and rack deployment, where the host chassis provides physical security. The USB-A variant regulates host 5V to 3.3V on board; the M.2 variant takes 3.3V from the host directly.

Cryptographic and Control Subsystems

Four-layer FR-4, 1.6 mm, ENIG finish; inner layers L2/L3 carry the active tamper mesh. Full bill of materials, pin-level interconnect, and connection maps are in the Zenodo deposit (DOI 10.5281/zenodo.20299821).

Enforces Authority, Takes No World Action

Unlike the BLADE domain nodes, which can gate a physical effector, BLADE-AGENT-HSM has no actuator that acts on the outside world. Its only outputs are a signed authorization, a PCR extension, a ledger entry, an indicator state, and a tamper alarm. It enforces authority by withholding a signature: an action the agent cannot get signed is an action it cannot prove was authorized, and a tier-bound tool token the device will not derive is a tool the agent cannot use.

System Schematic

Full subsystem node graph color-coded by type (MCU, Sensor, Actuator, Power, Module, Display). Shows the STM32L432 governance MCU at the center, the TPM 2.0, secure element, and discrete TRNG cryptographic subsystems, the tamper sensor block, the tier-indicator, alarm, and power LEDs, the piezo buzzer, the LDO power regulation and USB ESD protection, the RTC and HSE crystals, and the USB-A and M.2 Key-E host interfaces with data and power links.

Reference Configuration Cost

BLADE-AGENT-HSM is a low-cost secure module, an order of magnitude cheaper than the domain governance nodes. The reference bill of materials is dominated by the three cryptographic devices. The figures below are from the reference BOM and the first-article engineering estimate in the deposit.

Non-recurring engineering covers PCB layout, firmware, debug tooling, test fixtures, and documentation. At volume the per-unit cost falls further; the cryptographic devices set the floor.

Physical Specifications

Adversarial High-Assurance Emulator

The BLADE-AGENT-HSM emulator runs the full hardware behavior in the browser with real Web Crypto primitives (ECDSA P-256/P-384, SHA-256, HKDF) and no backend. It models the PCR measurement chains, the audit-ledger signing, the tier transitions, the spawn quorum, the per-tool zero-trust tokens, and the failure-mode scenarios, including a voltage glitch, an electronic-warfare hazard with recovery, split-brain ledger reconciliation, and Byzantine fault isolation. It exports a signed evidence bundle and runs a browser self-test.

The emulator and its core are reproduced by a bundled test suite of 275 deterministic checks across seven batteries (275 of 275 passing, confirmed over three reruns), plus a software-only-versus-HSM baseline that quantifies what the hardware anchor adds. A deterministic golden trace and a P-384 signed anchor allow independent verification.

Validation Metrics

Role in the Governance Stack

BLADE-AGENT-HSM is the seventh instantiation of the AUTHREX authority-governance framework and the first dedicated hardware root of trust in the family. The six domain governance nodes each embed a trust anchor internally; BLADE-AGENT-HSM extracts that anchor into a standalone, attachable device, and pairs it with the AUTHREX-AGENT software shim so the same hardware-rooted authority and audit chain is available to software AI agents and to any BLADE node. The seven governance architectures (SATA, HMAA, ADARA, MAIVA, FLAME, CARA, ERAM) are reused in their HSM-specific roles: attestation, tier enforcement, and deterministic recovery anchored in silicon.

SDK Integration

The AUTHREX-AGENT shim calls BLADE-AGENT-HSM through the same unified API used across the BLADE family. An agent opens the device, requests an authorization or a tool token, and receives a hardware-signed result. Only the configuration changes between domains.

domain: agent_hsm
root_of_trust: hardware

crypto:
  secure_element: nxp_se051   # CC EAL6+, keys
  tpm: infineon_slb9670       # PCR bank, quote
  trng: microchip_atsha204a   # 2nd-source entropy

abi:
  audit_sign:        ecdsa_p256_se051
  pcr_extend:        tpm
  pcr_quote:         tpm
  tool_auth:         hkdf_tier_bound
  spawn_quorum_sign: n_of_m_se051

authority:
  T3_autonomous: green
  T2_supervised: amber
  T1_confirmed:  red
  T0_halt:       blink_red_alarm

tamper:
  paths: [active_mesh, voltage_glitch, thermal]
  on_event: [zeroize_keys, pcr4_cause, tier_T0]

import blade_governance as bg

# Attach the hardware root of trust (AUTHREX-AGENT)
hsm = bg.AgentHSM("blade_agent_hsm.yaml")

# Authorize a tool call at the active tier:
tok = hsm.tool_auth(tool="wire_transfer", tier="T1")
if tok is None:
    agent.block("wire_transfer")   # above tier

# Sign the audit entry with a non-exportable key:
sig = hsm.audit_sign(ledger_hash)  # ECDSA P-256
hsm.pcr_extend(pcr=1, value=ledger_hash)
# sig.device_id, sig.pcr_quote -> attested record

Companion Paper & Documentation

The BLADE-AGENT-HSM companion paper (16 sections, 5 figures, 28 references), the Interface Control Document, the host-integration guide, and the complete reference-design files are deposited on Zenodo under DOI 10.5281/zenodo.20299821 (CC BY 4.0, v4.0).

Technology Readiness

BLADE-AGENT-HSM hardware is at approximately TRL 2-3 (specification and reference design); the emulator is at approximately TRL 3-4 (a research demonstrator running real Web Crypto). All silicon performance figures are design targets; silicon timing is modeled, not measured. Board fabrication, the provisioning key ceremony, and tamper-mesh calibration are post-petition deliverables.

Future Work

Repository & Reproducible Artifacts

BLADE-AGENT-HSM provides reproducible artifacts enabling independent verification of the authority behavior, the reference hardware design, and the emulator. All files are published open-access on Zenodo (DOI 10.5281/zenodo.20299821) and mirrored in the repository.

Reference Artifacts

BLADE-AGENT-HSM reference package. All files are original work by Burak Oktenli (Georgetown University, M.P.S. Applied Intelligence), published under CC BY 4.0 on Zenodo (DOI 10.5281/zenodo.20299821).

About This Project

The BLADE-AGENT-HSM Hardware Root of Trust is part of the authority-governed autonomy research program by Burak Oktenli at Georgetown University (M.P.S. Applied Intelligence). It is the seventh domain instantiation of the BLADE governance framework and the first hardware root of trust in the family, demonstrating that the same authority and evidence design developed across defense (BLADE-EDGE), automotive (BLADE-AV), maritime (BLADE-MARITIME), critical infrastructure (BLADE-INFRA), orbital (BLADE-SPACE), and counter-UAS (BLADE-CUAS) reference designs applies to securing autonomous AI agents.

Related architectures: SATA · HMAA · CARA · MAIVA · FLAME · ADARA · ERAM

View full research portfolio →

Citation

If you reference BLADE-AGENT-HSM in scholarly or policy work, please cite as follows.