security
Articles
The Safety Gate That Made Things Less Safe
A blanket permission rule on two production CLIs forced 157 approval prompts in a single day, 117 of them on one subcommand. Click fatigue is not safety.
The Agent Cited Itself
A provenance gate asked whether the agent read an identifier or composed it, and counted the agent reading its own instructions as reading it.
One Machine per Customer: Two Planes, Two Writers
Isolation lives in the deployment topology, and config authority is a separate question: two writers reach the same bucket and neither holds the other key.
The Grant Table Is the Kill Switch: Access Control for a Shared AI Employee
Several people share one autonomous agent: the identity provider proves who they are, but a grant read live on every request decides whether they still get in.
What an Agent May Do Is Not How It May Start
One authorization setting was answering two unrelated questions. Splitting exposure from initiation is what made the entitlement model enforceable.
We Accidentally Built a Shadow System of Record
A review caught our agent console rendering the customer's own data back to them. We had built a shadow system of record nobody designed.
An Agent That Can Edit Its Own Autonomy Ceiling Has No Ceiling
OS-level file ownership - not prompt instructions - is the only reliable way to prevent an AI agent from modifying its own governance constraints.
Dead Code Removal Is a Security Audit, Not Just Cleanup
Deleting old adapter code forces a semantic comparison you would not otherwise do - and that is where security gaps surface, not where they get introduced.
Give an Agent Powerful Capabilities Without Giving It Credentials
Least-privilege for autonomous agents: mediate every Google Workspace grant through a separate privilege-dropped broker, never hand the agent the credential.
You Cannot Instruct an Agent Not to Leak
Memory notes told the agent not to echo secret values. It did anyway, twice. The fix was structural enforcement at the tool boundary, not better instructions.