WEBVTT
00:00:00.160 --> 00:00:05.440
In the last episode, I told you about my little Hello Queen application.
00:00:05.679 --> 00:00:15.279
I asked Claude to make me something cute that would greet me every morning, call me a queen, give me a compliment, and then share an inspirational quote with me.
00:00:15.519 --> 00:00:17.280
And Claude did that.
00:00:17.920 --> 00:00:25.679
But it also did quite a few things that I had not explicitly asked it to do or thought I had given it permission to do.
00:00:26.000 --> 00:00:35.200
It published the app, executed it, scheduled it to run daily on my computer, and connected it to an external API that I had not fed.
00:00:35.759 --> 00:00:38.799
Which is what brings us to today's question.
00:00:39.119 --> 00:00:43.920
What permissions should we actually be giving to our AI agents?
00:00:44.159 --> 00:00:54.719
Because I'm starting to think that handing an agent access to your entire development environment and saying, please just do this one thing, but don't do any other stuff, okay?
00:00:55.119 --> 00:00:58.320
That might not be the greatest security strategy.
00:00:58.719 --> 00:01:01.359
Shocking! I know, right?
00:01:01.920 --> 00:01:06.400
Because there is a big problem with giving agents access to everything.
00:01:06.719 --> 00:01:11.920
So let's imagine you've hired a new junior developer and it is their first day.
00:01:12.079 --> 00:01:17.599
They are super enthusiastic, they seem capable, they are eager to help and learn.
00:01:17.920 --> 00:01:32.560
Would you immediately give them production admin credits, access to all the repositories, permission to modify your CI, your organization's secrets, and also the ability to deploy whatever they wanted?
00:01:32.879 --> 00:01:34.799
You probably would not, right?
00:01:35.439 --> 00:01:40.319
You'd probably give them the access that they actually need to do their job.
00:01:40.640 --> 00:01:51.280
And then as they take on new responsibilities, you'd grant additional access when appropriate, when you felt ready, assuming that they've been doing a good job.
00:01:51.680 --> 00:01:57.120
This isn't just good management, it's actually a security principle called least privilege.
00:01:57.680 --> 00:01:58.799
And it's not new.
00:01:59.040 --> 00:02:03.680
You probably actually do it with new colleagues and don't even realize it all the time.
00:02:03.920 --> 00:02:10.800
I teach how to do this intentionally and reliably all the time when I do training at SheaxPurple.
00:02:11.199 --> 00:02:18.719
But I think we need to revisit it now that we're giving AI systems the ability to take actions on our behalf.
00:02:18.960 --> 00:02:22.240
Because an AI agent isn't just answering questions for us.
00:02:22.400 --> 00:02:37.840
Depending on how you've configured it, it might be able to read and write files, execute commands, install packages, browse the net, interact with APIs, modify repositories, and even deploy software.
00:02:38.080 --> 00:02:42.240
And sometimes we give it all those capabilities because it's convenient.
00:02:42.479 --> 00:02:46.560
We want the agent to finish the task without interrupting us every five minutes.
00:02:46.800 --> 00:02:47.759
I get it.
00:02:48.000 --> 00:02:48.960
I get it.
00:02:49.520 --> 00:02:56.319
But convenience and unrestricted permissions should not be the same thing.
00:02:56.479 --> 00:03:00.639
And obviously, one of them can become a really big problem if we're not careful.
00:03:01.199 --> 00:03:05.439
Now I want to talk about permissions versus instructions.
00:03:05.680 --> 00:03:11.039
There's a distinction that I really want all software developers to understand.
00:03:11.360 --> 00:03:13.599
Actually, I want everyone to understand it.
00:03:13.840 --> 00:03:21.039
Telling an agent not to do something is not the same as preventing it from doing that thing.
00:03:21.360 --> 00:03:25.039
Let's say I give an agent access to my entire file system.
00:03:25.199 --> 00:03:30.960
Then I write a very clear instruction: only modify files inside this project directory, okay?
00:03:31.520 --> 00:03:33.520
That seems super reasonable, right?
00:03:33.680 --> 00:03:34.960
I'm being very clear.
00:03:35.039 --> 00:03:36.560
There's no ambiguity.
00:03:36.879 --> 00:03:46.800
But if the agent's tools allow it to read and modify files anywhere on my computer, then technically it still has that ability.
00:03:47.039 --> 00:03:51.360
The instruction is a direction, a request.
00:03:51.759 --> 00:03:53.599
A requirement, let's say.
00:03:53.919 --> 00:03:56.159
But permission is a capability.
00:03:56.400 --> 00:04:03.039
And security boundaries need to be enforced by the environment, not by whatever I say in a prompt.
00:04:03.280 --> 00:04:10.960
It's the same reason we don't secure a web application by putting a comment in the source code that says, please don't access other users' records, okay?
00:04:11.120 --> 00:04:12.879
Just look at your own stuff, right?
00:04:13.520 --> 00:04:15.120
Because that wouldn't work.
00:04:15.439 --> 00:04:20.240
We enforce authorization and access control with code.
00:04:20.480 --> 00:04:25.279
We check permissions with functions that deny by default.
00:04:25.519 --> 00:04:33.920
We design systems so that unauthorized action cannot succeed, even if something or someone tries to force it.
00:04:34.319 --> 00:04:42.079
But AI agents require the same engineering discipline, and for some reason we aren't doing it right now.
00:04:42.399 --> 00:04:46.639
We must have control over what they can and cannot do.
00:04:47.519 --> 00:04:49.439
So start with the task.
00:04:49.839 --> 00:04:53.279
What permissions should an AI agent actually have?
00:04:53.600 --> 00:05:00.639
So my answer, again, start with the task, not the tool, not the agent, what we need it to do.
00:05:01.120 --> 00:05:07.600
So here's a question that I want you all to ask before you even start assigning permissions, like just backing up a little bit.
00:05:07.839 --> 00:05:10.720
Does this actually even need to be an agent?
00:05:10.959 --> 00:05:14.480
Because not every single damn thing needs to be an agent.
00:05:14.879 --> 00:05:22.560
Sometimes regular software, a scheduled job, or a simple workflow can actually do all the things you need.
00:05:22.879 --> 00:05:32.639
Maybe you use AI for one specific part of the task, but that doesn't mean you need to give it tools and permissions to run around doing whatever it thinks is best.
00:05:33.360 --> 00:05:39.199
And if you don't need those capabilities in the first place, then you don't have to worry about securing them.
00:05:40.319 --> 00:05:44.879
Imagine I want an agent to review a pull request and suggest improvements.
00:05:45.360 --> 00:05:49.680
Does it need permission to deploy code to production in order to accomplish that?
00:05:49.920 --> 00:05:50.240
No.
00:05:51.120 --> 00:05:54.399
Does it need access to my cloud admin creds?
00:05:54.800 --> 00:05:55.120
No.
00:05:55.680 --> 00:05:58.639
Does it need permission to modify the repository?
00:05:58.879 --> 00:06:00.160
Maybe, maybe not.
00:06:00.399 --> 00:06:09.360
It might only need read access to the relevant code, the ability to inspect changes, and somewhere to put its recommendations for me.
00:06:10.399 --> 00:06:12.560
Now imagine a different task.
00:06:12.800 --> 00:06:16.800
I want an agent to update dependencies in a project for me.
00:06:17.120 --> 00:06:17.439
Okay.
00:06:18.480 --> 00:06:25.360
It probably needs permission to modify certain files and run the project's tests.
00:06:25.680 --> 00:06:30.959
But does it need access to every single repository in my entire organization?
00:06:31.199 --> 00:06:33.199
Does it need production credentials?
00:06:33.680 --> 00:06:39.519
Does it need permission to change the security settings on my source control platform?
00:06:41.199 --> 00:06:42.480
Probably not.
00:06:43.680 --> 00:06:49.519
So what I'm trying to say is that the permissions should match the work that we have asked it to do.
00:06:49.600 --> 00:06:59.199
And whenever possible, those permissions should be scoped to the specific project environment and duration of the task.
00:06:59.759 --> 00:07:02.399
What about when the agent needs more access?
00:07:02.560 --> 00:07:09.279
Now I can already hear someone saying, but Tanya, if I have to approve everything, doesn't that defeat the purpose of using an agent?
00:07:09.680 --> 00:07:12.480
I think we both know that's not what I'm suggesting.
00:07:12.639 --> 00:07:22.720
I'm not saying that we manually approve every file, every read, every test execution, because that would be exhausting and it would be a waste of time.
00:07:23.279 --> 00:07:31.040
But I am suggesting that we distinguish between routine actions and consequential actions.
00:07:31.439 --> 00:07:38.639
For example, if an agent running unit tests in an isolated development environment, okay, great.
00:07:38.959 --> 00:07:43.519
An agent suggesting changes to a configuration file, great.
00:07:44.160 --> 00:07:54.639
An agent deciding to install software from an unfamiliar source, send data to an external service, delete a database, or deploy source code into production.
00:07:55.439 --> 00:07:59.519
I would like a human involved in those decisions, please, and thank you.
00:08:00.720 --> 00:08:02.720
So here's something else.
00:08:03.040 --> 00:08:05.839
Approval should actually be meaningful.
00:08:06.079 --> 00:08:18.319
If an agent asks, may I execute this command and shows you a command that you do not understand, and then you click, sure, without thinking, that isn't much of a security control now, is it?
00:08:19.040 --> 00:08:22.240
We need to understand what we are approving.
00:08:22.720 --> 00:08:24.480
What will change?
00:08:25.199 --> 00:08:27.600
What information could leave the environment?
00:08:27.920 --> 00:08:30.160
Can the action be reversed?
00:08:30.480 --> 00:08:37.279
And if we're approving a specific action, the system should enforce that approval for that action.
00:08:37.440 --> 00:08:43.279
It shouldn't quietly turn into permission to do anything other than that action.
00:08:43.679 --> 00:08:48.639
What we want to do is give our agents a smaller area to play in.
00:08:48.799 --> 00:08:53.759
And one of the best ways to reduce risk is to change the environment itself.
00:08:54.320 --> 00:09:04.799
Rather than letting an agent operate directly on your everyday computer with all of your credentials, your personal files, etc., consider giving it an isolated workspace.
00:09:05.200 --> 00:09:13.679
A container, a temporary dev environment, a sandbox, or another appropriately restricted environment.
00:09:13.919 --> 00:09:17.200
Give it access to the project files that it needs.
00:09:17.519 --> 00:09:24.720
Use temporary credentials with narrowly scoped permissions when credentials are even necessary.
00:09:25.039 --> 00:09:29.679
Restrict its access to external services where practical.
00:09:29.919 --> 00:09:37.200
And make sure that when the task is finished, that any temporary access can be revoked and actually is revoked.
00:09:37.360 --> 00:09:42.720
This is especially important when agents can consume information from sources that we don't control.
00:09:43.360 --> 00:09:52.480
A malicious instruction hidden in a repository file, a web page, an issue description, a dependency documentation.
00:09:53.200 --> 00:09:58.399
It shouldn't suddenly become an opportunity to access everything on your machine.
00:09:58.879 --> 00:10:08.639
We can't necessarily control every piece of information an agent encounters, but we can limit what the agent is capable of doing with such information.
00:10:09.360 --> 00:10:17.679
And that's a much stronger security strategy than just hoping the agent will always interpret everything how we meant it.
00:10:19.440 --> 00:10:21.840
All of this is about limiting the damage.
00:10:22.000 --> 00:10:29.919
Everything that I am talking about is about limiting the blast radius if things go wrong because mistakes happen.
00:10:30.159 --> 00:10:40.799
Even without malicious instructions, an agent might misunderstand a request, make an incorrect assumption, or choose an approach we just didn't anticipate.
00:10:41.279 --> 00:10:48.320
If that agent has unrestricted access, a relatively small mistake could have enormous consequences.
00:10:48.720 --> 00:11:00.240
But if it can only modify files in one temporary workspace with no production credentials and no access to unrelated systems, the potential damage is a lot smaller.
00:11:00.480 --> 00:11:05.600
And that's what we security nerds mean when we talk about limiting the blast radius.
00:11:06.320 --> 00:11:16.080
We know that we can't prevent every single mistake, but we can design our systems so that one mistake doesn't become a catastrophe.
00:11:16.399 --> 00:11:19.039
And that's a super reasonable goal.
00:11:19.279 --> 00:11:21.840
So here's your one thing to do this week.
00:11:22.159 --> 00:11:23.360
Yes, that's right.
00:11:23.600 --> 00:11:25.200
You have homework.
00:11:25.679 --> 00:11:30.960
So pick one AI agent that you are currently using and open its settings.
00:11:31.200 --> 00:11:36.480
Look at the tools you've connected and examine the permissions that it actually has.
00:11:37.039 --> 00:11:39.200
Can it read your entire file system?
00:11:39.440 --> 00:11:41.440
Can it execute arbitrary commands?
00:11:41.679 --> 00:11:45.440
Does it have access to credentials or environment variables?
00:11:45.840 --> 00:11:52.399
Can it install dependencies, communicate with external services, or make changes without asking you?
00:11:52.879 --> 00:12:02.080
And here's the important question: Does it genuinely need all of those permissions for the tasks you're asking of it?
00:12:02.399 --> 00:12:07.840
And actually, while we're at it, does this task even need an agent?
00:12:08.080 --> 00:12:16.240
Could you accomplish the same thing with regular software and perhaps one super narrowly scoped AI feature instead?
00:12:17.200 --> 00:12:24.639
If it doesn't need to be an agent, just make plain old deterministic software instead.
00:12:25.360 --> 00:12:34.720
Okay, but if it does need to be an agent and it doesn't need all of those permissions, your thing to do is to take some of them away, at least one.
00:12:35.039 --> 00:12:37.759
Maybe you restrict it to a specific directory.
00:12:38.000 --> 00:12:41.919
Maybe you remove access to an integration that you're not using.
00:12:42.159 --> 00:12:49.519
Maybe you add a manual approval for a particularly sensitive action that you really need to have your eyes on.
00:12:49.919 --> 00:12:53.440
You don't have to redesign your entire development environment this afternoon.
00:12:53.519 --> 00:12:54.879
That's not what I'm saying.
00:12:55.120 --> 00:12:59.679
Just make your agents' permissions a little more intentional.
00:13:00.480 --> 00:13:04.399
Because the goal isn't to stop AI agents from being useful.
00:13:04.799 --> 00:13:10.960
It's to give them enough power to help us, but not enough to ruin our day.
00:13:11.440 --> 00:13:13.440
Or our production environment.
00:13:14.000 --> 00:13:15.120
Or both.
00:13:22.320 --> 00:13:25.120
Thank you for listening, and I will see you next time.
00:00:00.160 --> 00:00:05.440
In the last episode, I told you about my little Hello Queen application.
00:00:05.679 --> 00:00:15.279
I asked Claude to make me something cute that would greet me every morning, call me a queen, give me a compliment, and then share an inspirational quote with me.
00:00:15.519 --> 00:00:17.280
And Claude did that.
00:00:17.920 --> 00:00:25.679
But it also did quite a few things that I had not explicitly asked it to do or thought I had given it permission to do.
00:00:26.000 --> 00:00:35.200
It published the app, executed it, scheduled it to run daily on my computer, and connected it to an external API that I had not fed.
00:00:35.759 --> 00:00:38.799
Which is what brings us to today's question.
00:00:39.119 --> 00:00:43.920
What permissions should we actually be giving to our AI agents?
00:00:44.159 --> 00:00:54.719
Because I'm starting to think that handing an agent access to your entire development environment and saying, please just do this one thing, but don't do any other stuff, okay?
00:00:55.119 --> 00:00:58.320
That might not be the greatest security strategy.
00:00:58.719 --> 00:01:01.359
Shocking! I know, right?
00:01:01.920 --> 00:01:06.400
Because there is a big problem with giving agents access to everything.
00:01:06.719 --> 00:01:11.920
So let's imagine you've hired a new junior developer and it is their first day.
00:01:12.079 --> 00:01:17.599
They are super enthusiastic, they seem capable, they are eager to help and learn.
00:01:17.920 --> 00:01:32.560
Would you immediately give them production admin credits, access to all the repositories, permission to modify your CI, your organization's secrets, and also the ability to deploy whatever they wanted?
00:01:32.879 --> 00:01:34.799
You probably would not, right?
00:01:35.439 --> 00:01:40.319
You'd probably give them the access that they actually need to do their job.
00:01:40.640 --> 00:01:51.280
And then as they take on new responsibilities, you'd grant additional access when appropriate, when you felt ready, assuming that they've been doing a good job.
00:01:51.680 --> 00:01:57.120
This isn't just good management, it's actually a security principle called least privilege.
00:01:57.680 --> 00:01:58.799
And it's not new.
00:01:59.040 --> 00:02:03.680
You probably actually do it with new colleagues and don't even realize it all the time.
00:02:03.920 --> 00:02:10.800
I teach how to do this intentionally and reliably all the time when I do training at SheaxPurple.
00:02:11.199 --> 00:02:18.719
But I think we need to revisit it now that we're giving AI systems the ability to take actions on our behalf.
00:02:18.960 --> 00:02:22.240
Because an AI agent isn't just answering questions for us.
00:02:22.400 --> 00:02:37.840
Depending on how you've configured it, it might be able to read and write files, execute commands, install packages, browse the net, interact with APIs, modify repositories, and even deploy software.
00:02:38.080 --> 00:02:42.240
And sometimes we give it all those capabilities because it's convenient.
00:02:42.479 --> 00:02:46.560
We want the agent to finish the task without interrupting us every five minutes.
00:02:46.800 --> 00:02:47.759
I get it.
00:02:48.000 --> 00:02:48.960
I get it.
00:02:49.520 --> 00:02:56.319
But convenience and unrestricted permissions should not be the same thing.
00:02:56.479 --> 00:03:00.639
And obviously, one of them can become a really big problem if we're not careful.
00:03:01.199 --> 00:03:05.439
Now I want to talk about permissions versus instructions.
00:03:05.680 --> 00:03:11.039
There's a distinction that I really want all software developers to understand.
00:03:11.360 --> 00:03:13.599
Actually, I want everyone to understand it.
00:03:13.840 --> 00:03:21.039
Telling an agent not to do something is not the same as preventing it from doing that thing.
00:03:21.360 --> 00:03:25.039
Let's say I give an agent access to my entire file system.
00:03:25.199 --> 00:03:30.960
Then I write a very clear instruction: only modify files inside this project directory, okay?
00:03:31.520 --> 00:03:33.520
That seems super reasonable, right?
00:03:33.680 --> 00:03:34.960
I'm being very clear.
00:03:35.039 --> 00:03:36.560
There's no ambiguity.
00:03:36.879 --> 00:03:46.800
But if the agent's tools allow it to read and modify files anywhere on my computer, then technically it still has that ability.
00:03:47.039 --> 00:03:51.360
The instruction is a direction, a request.
00:03:51.759 --> 00:03:53.599
A requirement, let's say.
00:03:53.919 --> 00:03:56.159
But permission is a capability.
00:03:56.400 --> 00:04:03.039
And security boundaries need to be enforced by the environment, not by whatever I say in a prompt.
00:04:03.280 --> 00:04:10.960
It's the same reason we don't secure a web application by putting a comment in the source code that says, please don't access other users' records, okay?
00:04:11.120 --> 00:04:12.879
Just look at your own stuff, right?
00:04:13.520 --> 00:04:15.120
Because that wouldn't work.
00:04:15.439 --> 00:04:20.240
We enforce authorization and access control with code.
00:04:20.480 --> 00:04:25.279
We check permissions with functions that deny by default.
00:04:25.519 --> 00:04:33.920
We design systems so that unauthorized action cannot succeed, even if something or someone tries to force it.
00:04:34.319 --> 00:04:42.079
But AI agents require the same engineering discipline, and for some reason we aren't doing it right now.
00:04:42.399 --> 00:04:46.639
We must have control over what they can and cannot do.
00:04:47.519 --> 00:04:49.439
So start with the task.
00:04:49.839 --> 00:04:53.279
What permissions should an AI agent actually have?
00:04:53.600 --> 00:05:00.639
So my answer, again, start with the task, not the tool, not the agent, what we need it to do.
00:05:01.120 --> 00:05:07.600
So here's a question that I want you all to ask before you even start assigning permissions, like just backing up a little bit.
00:05:07.839 --> 00:05:10.720
Does this actually even need to be an agent?
00:05:10.959 --> 00:05:14.480
Because not every single damn thing needs to be an agent.
00:05:14.879 --> 00:05:22.560
Sometimes regular software, a scheduled job, or a simple workflow can actually do all the things you need.
00:05:22.879 --> 00:05:32.639
Maybe you use AI for one specific part of the task, but that doesn't mean you need to give it tools and permissions to run around doing whatever it thinks is best.
00:05:33.360 --> 00:05:39.199
And if you don't need those capabilities in the first place, then you don't have to worry about securing them.
00:05:40.319 --> 00:05:44.879
Imagine I want an agent to review a pull request and suggest improvements.
00:05:45.360 --> 00:05:49.680
Does it need permission to deploy code to production in order to accomplish that?
00:05:49.920 --> 00:05:50.240
No.
00:05:51.120 --> 00:05:54.399
Does it need access to my cloud admin creds?
00:05:54.800 --> 00:05:55.120
No.
00:05:55.680 --> 00:05:58.639
Does it need permission to modify the repository?
00:05:58.879 --> 00:06:00.160
Maybe, maybe not.
00:06:00.399 --> 00:06:09.360
It might only need read access to the relevant code, the ability to inspect changes, and somewhere to put its recommendations for me.
00:06:10.399 --> 00:06:12.560
Now imagine a different task.
00:06:12.800 --> 00:06:16.800
I want an agent to update dependencies in a project for me.
00:06:17.120 --> 00:06:17.439
Okay.
00:06:18.480 --> 00:06:25.360
It probably needs permission to modify certain files and run the project's tests.
00:06:25.680 --> 00:06:30.959
But does it need access to every single repository in my entire organization?
00:06:31.199 --> 00:06:33.199
Does it need production credentials?
00:06:33.680 --> 00:06:39.519
Does it need permission to change the security settings on my source control platform?
00:06:41.199 --> 00:06:42.480
Probably not.
00:06:43.680 --> 00:06:49.519
So what I'm trying to say is that the permissions should match the work that we have asked it to do.
00:06:49.600 --> 00:06:59.199
And whenever possible, those permissions should be scoped to the specific project environment and duration of the task.
00:06:59.759 --> 00:07:02.399
What about when the agent needs more access?
00:07:02.560 --> 00:07:09.279
Now I can already hear someone saying, but Tanya, if I have to approve everything, doesn't that defeat the purpose of using an agent?
00:07:09.680 --> 00:07:12.480
I think we both know that's not what I'm suggesting.
00:07:12.639 --> 00:07:22.720
I'm not saying that we manually approve every file, every read, every test execution, because that would be exhausting and it would be a waste of time.
00:07:23.279 --> 00:07:31.040
But I am suggesting that we distinguish between routine actions and consequential actions.
00:07:31.439 --> 00:07:38.639
For example, if an agent running unit tests in an isolated development environment, okay, great.
00:07:38.959 --> 00:07:43.519
An agent suggesting changes to a configuration file, great.
00:07:44.160 --> 00:07:54.639
An agent deciding to install software from an unfamiliar source, send data to an external service, delete a database, or deploy source code into production.
00:07:55.439 --> 00:07:59.519
I would like a human involved in those decisions, please, and thank you.
00:08:00.720 --> 00:08:02.720
So here's something else.
00:08:03.040 --> 00:08:05.839
Approval should actually be meaningful.
00:08:06.079 --> 00:08:18.319
If an agent asks, may I execute this command and shows you a command that you do not understand, and then you click, sure, without thinking, that isn't much of a security control now, is it?
00:08:19.040 --> 00:08:22.240
We need to understand what we are approving.
00:08:22.720 --> 00:08:24.480
What will change?
00:08:25.199 --> 00:08:27.600
What information could leave the environment?
00:08:27.920 --> 00:08:30.160
Can the action be reversed?
00:08:30.480 --> 00:08:37.279
And if we're approving a specific action, the system should enforce that approval for that action.
00:08:37.440 --> 00:08:43.279
It shouldn't quietly turn into permission to do anything other than that action.
00:08:43.679 --> 00:08:48.639
What we want to do is give our agents a smaller area to play in.
00:08:48.799 --> 00:08:53.759
And one of the best ways to reduce risk is to change the environment itself.
00:08:54.320 --> 00:09:04.799
Rather than letting an agent operate directly on your everyday computer with all of your credentials, your personal files, etc., consider giving it an isolated workspace.
00:09:05.200 --> 00:09:13.679
A container, a temporary dev environment, a sandbox, or another appropriately restricted environment.
00:09:13.919 --> 00:09:17.200
Give it access to the project files that it needs.
00:09:17.519 --> 00:09:24.720
Use temporary credentials with narrowly scoped permissions when credentials are even necessary.
00:09:25.039 --> 00:09:29.679
Restrict its access to external services where practical.
00:09:29.919 --> 00:09:37.200
And make sure that when the task is finished, that any temporary access can be revoked and actually is revoked.
00:09:37.360 --> 00:09:42.720
This is especially important when agents can consume information from sources that we don't control.
00:09:43.360 --> 00:09:52.480
A malicious instruction hidden in a repository file, a web page, an issue description, a dependency documentation.
00:09:53.200 --> 00:09:58.399
It shouldn't suddenly become an opportunity to access everything on your machine.
00:09:58.879 --> 00:10:08.639
We can't necessarily control every piece of information an agent encounters, but we can limit what the agent is capable of doing with such information.
00:10:09.360 --> 00:10:17.679
And that's a much stronger security strategy than just hoping the agent will always interpret everything how we meant it.
00:10:19.440 --> 00:10:21.840
All of this is about limiting the damage.
00:10:22.000 --> 00:10:29.919
Everything that I am talking about is about limiting the blast radius if things go wrong because mistakes happen.
00:10:30.159 --> 00:10:40.799
Even without malicious instructions, an agent might misunderstand a request, make an incorrect assumption, or choose an approach we just didn't anticipate.
00:10:41.279 --> 00:10:48.320
If that agent has unrestricted access, a relatively small mistake could have enormous consequences.
00:10:48.720 --> 00:11:00.240
But if it can only modify files in one temporary workspace with no production credentials and no access to unrelated systems, the potential damage is a lot smaller.
00:11:00.480 --> 00:11:05.600
And that's what we security nerds mean when we talk about limiting the blast radius.
00:11:06.320 --> 00:11:16.080
We know that we can't prevent every single mistake, but we can design our systems so that one mistake doesn't become a catastrophe.
00:11:16.399 --> 00:11:19.039
And that's a super reasonable goal.
00:11:19.279 --> 00:11:21.840
So here's your one thing to do this week.
00:11:22.159 --> 00:11:23.360
Yes, that's right.
00:11:23.600 --> 00:11:25.200
You have homework.
00:11:25.679 --> 00:11:30.960
So pick one AI agent that you are currently using and open its settings.
00:11:31.200 --> 00:11:36.480
Look at the tools you've connected and examine the permissions that it actually has.
00:11:37.039 --> 00:11:39.200
Can it read your entire file system?
00:11:39.440 --> 00:11:41.440
Can it execute arbitrary commands?
00:11:41.679 --> 00:11:45.440
Does it have access to credentials or environment variables?
00:11:45.840 --> 00:11:52.399
Can it install dependencies, communicate with external services, or make changes without asking you?
00:11:52.879 --> 00:12:02.080
And here's the important question: Does it genuinely need all of those permissions for the tasks you're asking of it?
00:12:02.399 --> 00:12:07.840
And actually, while we're at it, does this task even need an agent?
00:12:08.080 --> 00:12:16.240
Could you accomplish the same thing with regular software and perhaps one super narrowly scoped AI feature instead?
00:12:17.200 --> 00:12:24.639
If it doesn't need to be an agent, just make plain old deterministic software instead.
00:12:25.360 --> 00:12:34.720
Okay, but if it does need to be an agent and it doesn't need all of those permissions, your thing to do is to take some of them away, at least one.
00:12:35.039 --> 00:12:37.759
Maybe you restrict it to a specific directory.
00:12:38.000 --> 00:12:41.919
Maybe you remove access to an integration that you're not using.
00:12:42.159 --> 00:12:49.519
Maybe you add a manual approval for a particularly sensitive action that you really need to have your eyes on.
00:12:49.919 --> 00:12:53.440
You don't have to redesign your entire development environment this afternoon.
00:12:53.519 --> 00:12:54.879
That's not what I'm saying.
00:12:55.120 --> 00:12:59.679
Just make your agents' permissions a little more intentional.
00:13:00.480 --> 00:13:04.399
Because the goal isn't to stop AI agents from being useful.
00:13:04.799 --> 00:13:10.960
It's to give them enough power to help us, but not enough to ruin our day.
00:13:11.440 --> 00:13:13.440
Or our production environment.
00:13:14.000 --> 00:13:15.120
Or both.
00:13:22.320 --> 00:13:25.120
Thank you for listening, and I will see you next time.
