The Missing Ring-0 Protections for AI Agents

An essay argues that coding agents like Claude Code, Codex CLI and Gemini CLI act with the developer's full authority, effectively at ring 0, with no independent check between model output and system action. It proposes a reference monitor that stages effects first and gates each change on fixed rules rather than a model, and outlines an unrun study to test whether such a deterministic supervisor adds anything over existing systems.