Security

Agents are fluent. Fluency is not the same as safe. If you are rolling AI agents into a real org, you already know the demo version of this problem. The model sounds careful. The slide says “guardrails.” Someone writes “do not touch production” in a prompt, and the room relaxes. That sentence is a sticky note. It is not a control. When the agent is in a hurry, or the chat got cut short, or it found a clever way to spell the same dangerous action, the sticky note is already gone. ...

Companion to The last click is still yours and the agent production system series. Words I use below Agent — a program that writes code for you in a chat session Pull request (PR) — a proposed change waiting for review; on GitHub it has its own page, with a button to accept it Merge — accepting that proposed change so it becomes part of the main project Personal login — you, signed in as yourself; when you type commands, GitHub sees your name GitHub App — a robot you install on a GitHub project so it can click buttons as itself — not as you; it can approve, and it can merge Short-lived token — a temporary key the robot gets to prove it may click; it dies in about an hour, and after that it is junk PAT (personal access token) — a long-lived key tied to you; if it leaks into a chat log, it keeps working until someone turns it off Broker — a small program that hands out a short-lived token when the rules say yes; the agent asks, the broker decides, and the agent does not invent a key Automatic tests — programs that run by themselves when you propose a change; green means they passed Those nine words are the toolkit. Now the point. ...