Safety & Guardrails
Prompt injection, permissions, sandboxing, human checkpoints.
24 posts · showing 11–20
-
Compliance and Audit for Agent-Written Systems
The audit questions don't change — who's responsible, how do you know it's correct, show me this case. They become answerable differently, and an actor field saying "agent-service" answers the first one not at all.
-
Security Review When Nobody Wrote the Code
Human vulnerabilities carry a tell — hurried code, an obvious shortcut. Generated code is uniformly careful-looking, so scanning for the suspicious part stops working. But its consistency cuts both ways.
-
Accountability Cannot Be Delegated to a Model
"The agent decided" answers nothing — not legally, not organizationally, not to the person affected. What accountability actually requires has design consequences, including why a rubber-stamp gate is worse than none.
-
The Tool That Changed Under You: Supply-Chain Risk in Agent Tooling
No deploy, no prompt edit, and an ops agent started restarting services mid-investigation. A maintainer had improved a tool's documentation — and documentation, in an agent, is instruction.
-
Content Boundaries: What Your Agent Should Refuse, and How to Test It
Providers handle the general case. Scope, regulatory limits, commitments, and how your agent represents you are yours — and the test suite needs both halves, or you'll ship something that refuses everything.
-
Least Privilege for Agent Credentials
Since injection isn't fully preventable, the credential decides whether a compromise is an inconvenience or an incident. Four scoping dimensions — and the one nobody uses is usually the highest-value.
-
Audit Logs That Survive an Incident
Audit logs get designed for compliance and used during incidents. One question — who caused what, to whom, under what authority — decides every field, and most logs can't answer the authority part.
-
Data Exfiltration Paths You Forgot Your Agent Had
A URL fetch sends data in the request. A rendered markdown image leaks from the viewer's browser, bypassing every tool-level control. Enumerate the paths — several of them look like features.
-
Sandboxing Code Execution: What a `run_code` Tool Actually Needs
One tool replaces dozens — and hands a model that reads untrusted text a general-purpose mechanism for doing anything the process can do. Four boundaries, four isolation levels, and the one people leave open.
-
Designing a Kill Switch That Works Mid-Run
Killing the process leaves side effects in an unknown state. A stop that works checks between steps — before every model call and before every tool call — and the difference matters most at 2am.